Skip to content

TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.

License

Notifications You must be signed in to change notification settings

abhinavbom/Threat-Intelligence-Hunter

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.

#Threat-Intelligence-Hunter

Build Status Twitter URL Crates.io

Coverity Scan Build Status

####Summary TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.

Requirements

  • Python 2.7
  • Argparse
  • Requests
  • API keys from Virustotal and URLVoid

you can run the following command to install all the required packages in a go.

pip install -r requirements.txt

Features

  • Local storage of threat feeds

This allows you to regularly update your local storage from listed feeds under feeds.py. You can add your own favourite list if it is missing from the list.

python tih.py -update
  • Check an IP against existing threat feeds and your local database
python tih.py -ip <IP Address to lookup>
  • check for Bulk IP address list(in a text file)
python tih.py -list <file.txt>
  • Check for MD5 Hash
python tih.py -md5 <hash>
  • Check URL for blacklisting
python tih.py -url <your_url>
  • Check for IP/URL reputation (Currently supports URLVoid and Virustotal) Before using this feature, make sure you have added your public keys for URLVoid and VT to urlvoid.py and vt.py respectively.
python tih.py -repo <URL/IP>

Final Version -> Darklord

No more limits. Keep adding your updates and changes

Previous Version -> Bellatrix Lestrange

This version will have a more organized output and search mechanism.

Current version -> Peter Pettigrew v0.8

This version adds support for local storage of feeds.

Previous versions ->

Rita Skeeter v0.6

This version will have support for domains as indicators.

Lucious Malfoy v0.4

This version will have support for MD5 as Commandline input as well as a list inside a TXT file.

Draco Malfoy v0.2.

Now supports a list of IP addresses as indicators. Supports Single or multiple IPs as commandline arguments and parses it against a list of indicators.

About

TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages