Zeek Intel Threat Feed con indicadores combinados

Este es un feed público basado en feeds públicos de amenazas y en datos recopilados por CRITICAL PATH SECURITY. Este feed se actualizará con la mayor frecuencia posible.

Primeros pasos

Estas instrucciones le permitirán obtener una copia del proyecto y ponerlo en funcionamiento.

Dependencias

• ZEEK 3.0 o superior

Instalación

Instalar las dependencias de Zeek

sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev

Clona el repositorio en /opt

cd /opt
git clone --recursive https://github.com/zeek/zeek
./configure && make && sudo make install

Instalar Zeek

./configure && make && sudo make install

Instalar los feeds de inteligencia de amenazas

Clona el repositorio en /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds

cd /opt
git clone https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds.git /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds
echo "@load Zeek-Intelligence-Feeds" >> /usr/local/zeek/share/zeek/site/local.zeek

Uso

Navegue hasta /usr/local/zeek/bin/

./zeekctl deploy

Programación de actualizaciones

Se puede usar un script bash simple para las actualizaciones. A continuación se muestra un ejemplo.

vi /opt/zeek_update.sh

Añade lo siguiente:

#!/bin/sh
cd /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds && git fetch origin master
git reset --hard FETCH_HEAD
git clean -df

Haz que el script sea ejecutable.

chmod +x /opt/zeek_update.sh

Cree la siguiente entrada de cron para actualizaciones cada 24 horas.

5 * * * * sh /opt/zeek_update.sh >/dev/null 2>&1

Los registros se escribirán en:

/usr/local/zeek/logs/current/intel.log

Sources:

Filename	Provider	Homepage	List URL	License/TOU
Amnesty_NSO_Domains.intel	Amnesty NSO Domains	https://github.com/AmnestyTech/investigations	https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso	No definida
abuse-ch-ipblocklist.intel	Abuse.CH Blacklist	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/
abuse-ch-malware.intel	Abuse.CH Malware	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/
abuse-ch-threatfox-ip.intel	Abuse.CH ThreatFox	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/
abuse-ch-urlhaus.intel	Abuse.CH URLHaus	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/
alienvault.intel	AlienVault	https://www.alienvault.com/	http://reputation.alienvault.com/reputation.data	https://otx.alienvault.com/
binarydefense.intel	Binary Defense	https://www.binarydefense.com/	https://www.binarydefense.com/banlist.txt	https://www.binarydefense.com/
censys.intel	Censys	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cobaltstrike_ips.intel	CobaltStrike IP	https://threatview.io/	https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt	https://threatview.io/
compromised-ips.intel	Emerging Threats	https://rules.emergingthreats.net/	https://rules.emergingthreats.net/blockrules/compromised-ips.txt	https://rules.emergingthreats.net/OPEN_download_instructions.html
cps-collected-iocs.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_domain.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
ellio.intel	Ellio Tech	https://www.ellio.tech	https://www.ellio.tech	https://www.ellio.tech
fangxiao.intel	Cyjax	https://www.cyjax.com/	https://www.cyjax.com/app/uploads/2022/11/fangxiao-a-chinese-threat-actor.txt	https://www.cyjax.com/2022/11/14/fangxiao-a-chinese-threat-actor/
filetransferportals.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
illuminate.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
inversion.intel	Google / Inversion	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists	Github	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists/blob/main/LICENSE
lockbit_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
log4j_ip.intel	Múltiples fuentes	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
openphish.intel	OpenPhish	https://openphish.com	https://openphish.com/feed.txt	https://openphish.com/terms.html
predict_intel.intel	Georgia Tech Research Institute (GTRI)	https://www.gatech.edu/	https://www.gatech.edu/	https://www.gatech.edu/
ragnar.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
sans.intel	SANS	https://isc.sans.edu/	https://isc.sans.edu/api/intelfeed	https://isc.sans.edu/data/threatfeed.html
scumbots.intel	ScumBots	Ninguno	Ninguno	Permiso otorgado por Paul Melson - Uso gratuito
stalkerware.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
tor-exit.intel	Tor Project	https://www.torproject.org/	https://check.torproject.org/exit-addresses	https://www.torproject.org/
Wed Oct 21 07:02:34 UTC 2026