Zeek Intel Threat Feed mit kombinierten Indikatoren

Dies ist ein öffentlicher Feed, der auf öffentlichen Threat Feeds und von CRITICAL PATH SECURITY gesammelten Daten basiert. Dieser Feed wird so oft wie möglich aktualisiert.

Erste Schritte

Diese Anweisungen helfen Ihnen, eine Kopie des Projekts zum Laufen zu bringen.

Abhängigkeiten

ZEEK 3.0 oder höher

Installation

ZEEK-Abhängigkeiten installieren

sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev

Klonen Sie das Repository nach /opt

cd /opt
git clone --recursive https://github.com/zeek/zeek
./configure && make && sudo make install

Zeek installieren

./configure && make && sudo make install

Threat Intelligence Feeds installieren

Klonen Sie das Repository nach /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds

cd /opt
git clone https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds.git /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds
echo "@load Zeek-Intelligence-Feeds" >> /usr/local/zeek/share/zeek/site/local.zeek

Verwendung

Navigieren Sie zu /usr/local/zeek/bin/

./zeekctl deploy

Updates planen

Ein einfaches Bash-Skript kann für Updates verwendet werden. Ein Beispiel ist unten dargestellt.

vi /opt/zeek_update.sh

Fügen Sie Folgendes hinzu:

#!/bin/sh
cd /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds && git fetch origin master
git reset --hard FETCH_HEAD
git clean -df

Machen Sie das Skript ausführbar.

chmod +x /opt/zeek_update.sh

Erstellen Sie den folgenden Cron-Eintrag für 24-Stunden-Updates.

5 * * * * sh /opt/zeek_update.sh >/dev/null 2>&1

Logs werden geschrieben nach:

/usr/local/zeek/logs/current/intel.log

Quellen:

Amnesty_NSO_Domains.intel	Amnesty NSO Domains	https://github.com/AmnestyTech/investigations	https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso	Nicht definiert
abuse-ch-ipblocklist.intel	Abuse.CH Blacklist	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/
abuse-ch-malware.intel	Abuse.CH Malware	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/
abuse-ch-threatfox-ip.intel	Abuse.CH ThreatFox	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/
abuse-ch-urlhaus.intel	Abuse.CH URLHaus	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/
alienvault.intel	AlienVault	https://www.alienvault.com/	http://reputation.alienvault.com/reputation.data	https://otx.alienvault.com/
binarydefense.intel	Binary Defense	https://www.binarydefense.com/	https://www.binarydefense.com/banlist.txt	https://www.binarydefense.com/
censys.intel	Censys	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cobaltstrike_ips.intel	CobaltStrike IP	https://threatview.io/	https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt	https://threatview.io/
compromised-ips.intel	Emerging Threats	https://rules.emergingthreats.net/	https://rules.emergingthreats.net/blockrules/compromised-ips.txt	https://rules.emergingthreats.net/OPEN_download_instructions.html
cps-collected-iocs.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_domain.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
ellio.intel	Ellio Tech	https://www.ellio.tech	https://www.ellio.tech	https://www.ellio.tech
fangxiao.intel	Cyjax	https://www.cyjax.com/	https://www.cyjax.com/app/uploads/2022/11/fangxiao-a-chinese-threat-actor.txt	https://www.cyjax.com/2022/11/14/fangxiao-a-chinese-threat-actor/
filetransferportals.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
illuminate.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
inversion.intel	Google / Inversion	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists	Github	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists/blob/main/LICENSE
lockbit_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
log4j_ip.intel	Mehrere Quellen	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
openphish.intel	OpenPhish	https://openphish.com	https://openphish.com/feed.txt	https://openphish.com/terms.html
predict_intel.intel	Georgia Tech Research Institute (GTRI)	https://www.gatech.edu/	https://www.gatech.edu/	https://www.gatech.edu/
ragnar.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
sans.intel	SANS	https://isc.sans.edu/	https://isc.sans.edu/api/intelfeed	https://isc.sans.edu/data/threatfeed.html
scumbots.intel	ScumBots	Keine	Keine	Erlaubnis erteilt von Paul Melson - Kostenlose Nutzung
stalkerware.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
tor-exit.intel	Tor Project	https://www.torproject.org/	https://check.torproject.org/exit-addresses	https://www.torproject.org/
Mon Aug 3 21:02:33 UTC 2026

Zeek-Intelligence-Feeds

Beliebteste