Skip to content

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

License

Notifications You must be signed in to change notification settings

elliotechayush/Open-Source-Threat-Intel-Feeds

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

37 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Free Threat Intel/IOC Feeds Tweet

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds.cvs is stored in a structured manner based on the Vendor, Description, Category and the URL. The vendors offering ThreatIntelFeeds are described below. The following feed categories are available:

  • SSL
  • IP
  • DNS
  • URL
  • MD5
  • SHA1
  • SHA256
  • CVEID

IOC Feed Statistics

Category Count
DNS 7
IP 50
MD5 10
SHA1 3
SHA256 7
SSL 1
URL 16
CVEID 3

Combine Threat Intel in your EDR and SIEM

The feeds available in this repository can be used to perform threat hunting in your EDR or SIEM solution to hunt for malicious activity. For Defender For Endpoint and Sentinel some KQL hunting rules have already been written to be implemented in your EDR or SIEM. See: KQL Hunting Queries

Contributions

Contributions are much appreciated to make this list with free Threat Intel/IOC feeds as big and as up to date as possible. You can contribute by creating a pull request. This PR must contain the following content:

  1. Add the link of the feed in the README.md file. If there is not a section yet in which the source fits, create a new section.
  2. Add the details to the ThreatIntelFeeds.csv file, the format which is used is shown below. The Category refers to the feed categories shown above.
    Vendor;Description;Category;Url
    
  3. The source must be free and usable without any account or API token needed.
  4. Use the Validator.py script to validate the content of the CSV file. This can be done by running it in the script directory.
  5. Update the IOC Feed Statistics table by running the GenerateTableStatistics.py which will save the markdown table in the StatisticsTable.md file. This table can then be pasted above.

ELLIO: IP Feed (Community version)

Home page: https://ellio.tech Terms of Service: https://ellio.tech/beta-terms-and-conditions

Abuse.ch

Terms of Service: https://sslbl.abuse.ch/blacklist/, https://feodotracker.abuse.ch/blocklist/

Blocklist.de

Terms of Service: https://www.blocklist.de/en/index.html

IPSum

C2IntelFeeds

C2-Tracker

Carbon Black

tweetfeed.live

Botvrij

Proofpoint

CINSscore

Phishing Army

Alienvault

Cisco Talos

Binarydefense

CISA

eCrimeLabs

MISP Feed CERT-FR

Mr. Looquer IOC Feed

SNORT

CyberCure

OpenPhish

PhishTank

Cert.PL

GreenSnow

Mirai Security

NIST

Other Github based feeds

Notable links

Sources with multiple feeds depending on threat

About

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%