BRIntelcollector

Overview

The BRIntelcollector is a Cyber Threat Intelligence (CTI) tool focused on Brazilian national threat indicators. The tool allows searching and consolidating information about cyber threats through multiple intelligence sources, facilitating the creation of a centralized database for security analysis.

Objectives

• Collect Brazilian national threat indicators
• Integrate multiple CTI sources into a single interface
• Facilitate threat searching and identification
• Assist organizations in searching for potential relevant threats

Data Sources

Currently, the tool integrates two main intelligence sources:

1. OTX (Open Threat Exchange) - AlienVault
2. XFE (X-Force Exchange) - IBM

Prerequisites

Software

• Python 3+
• pip (corresponding to the Python version)

API Credentials

You need to obtain API keys from the following platforms:

• Open Threat Exchange (OTX): https://otx.alienvault.com
• IBM X-Force Exchange: https://exchange.xforce.ibmcloud.com

Important: The IBM key must be in the format key:password encoded in Base64.

Installation

1. Install the package

pip3 install BRIntel1

2. Configure environment variables

Create a .env file with your credentials:

echo "OTX_KEY = '<sua chave>'" > .env
echo "IBM_KEY = '<sua chave + senha em base64>'" >> .env

Example of encoding the IBM key:

echo -n "sua_chave:sua_senha" | base64

Usage

Search in All Sources

Full Search (Absolute Data)

from BRIntel import allSources

# Returns a list of dictionaries containing all data from the sources
resultados = allSources("Search term")

Default Search (Simplified Data)

from BRIntel import default

# Returns a list of dictionaries in a standardized format
resultados = default("Search term")

Default Return Structure

The default() function returns data in the following format:

Search in Specific Sources

IBM X-Force Exchange (XFE)

from BRIntel import xfe

# Search in XFE (returns STIX 2.1 format)
resultados_xfe = xfe.search("Search term")

# Display in default format
xfe.show(resultados_xfe[0])

# Get full details of a specific report
detalhes = xfe.details(resultados_xfe[0]["id"])

Open Threat Exchange (OTX)

from BRIntel import otx

# Search in OTX (returns open OTX pulse format)
resultados_otx = otx.search("Search term")

# Display in default format
otx.show(resultados_otx[0])

# Get full details of a specific pulse
detalhes = otx.details(resultados_otx[0]["id"])

Usage Examples

Example 1: Simple Search

from BRIntel import default

# Search for a suspicious domain
resultados = default("exemplo.com.br")

for resultado in resultados:
    print(f"Title: {resultado['title']}")
    print(f"Author: {resultado['author']}")
    print(f"TLP: {resultado['tlp']}")
    print(f"URL: {resultado['url']}")
    print("-" * 50)

Example 2: Search with Details

from BRIntel import otx, xfe

# Search in both sources
resultados_otx = otx.search("malware Brasil")
resultados_xfe = xfe.search("malware Brasil")

# Get details of the first result from each source
if resultados_otx:
    detalhes_otx = otx.details(resultados_otx[0]["id"])
    print("OTX details:", detalhes_otx)

if resultados_xfe:
    detalhes_xfe = xfe.details(resultados_xfe[0]["id"])
    print("XFE details:", detalhes_xfe)

Example 3: Cross-Source Comparison

from BRIntel import allSources

# Search all sources with full data
todas_fontes = allSources("phishing")

print(f"Total results found: {len(todas_fontes)}")

for item in todas_fontes:
    print(f"Source: {item.get('fonte', 'N/A')}")
    print(f"Title: {item.get('title', 'N/A')}")

Traffic Light Protocol (TLP)

The tool uses the TLP standard for information sharing classification:

• TLP:RED - Restricted information, do not share
• TLP:AMBER - Limited sharing
• TLP:GREEN - Community-wide sharing
• TLP:WHITE - Unlimited public sharing

More information: https://www.gov.br/cisc/pt-br/tlp

Data Formats

• OTX: Returns data in the open OTX pulse format
• XFE: Returns data in STIX 2.1 format

Use Cases

1. Threat Analysis: Identify malicious campaigns targeting Brazil
2. Incident Investigation: Correlate indicators with known threats
3. Threat Hunting: Proactively search for indicators of compromise
4. IOC Enrichment: Add context to collected indicators
5. Intelligence Reports: Consolidate information for executive reports

Best Practices

1. Credential Management: Never share or commit your API keys
2. Rate Limiting: Respect the API request limits
3. Data Validation: Always validate and contextualize the obtained results
4. Regular Updates: Keep the library updated for new features
5. TLP Documentation: Respect the TLP classifications of reports

Limitations

• Dependence on external APIs (requires connectivity and valid credentials)
• Currently limited to OTX and XFE sources
• Subject to the rate limits of the used APIs

Contributing

To contribute to the project, visit the repository on GitHub: https://github.com/devfoundsec/BRIntelcollector

Support

To report bugs or request features, open an issue on the project's GitHub.

References

• AlienVault OTX
• IBM X-Force Exchange
• STIX 2.1 Documentation
• Traffic Light Protocol - Gov.br

Developed by: devfoundsec
Repository: https://github.com/devfoundsec/BRIntelcollector