Zeek Intel 위협 피드 (통합 지표 포함)

이것은 공개 위협 피드와 CRITICAL PATH SECURITY가 수집한 데이터를 기반으로 하는 공개 피드입니다. 이 피드는 가능한 한 자주 업데이트됩니다.

시작하기

이 지침을 통해 프로젝트 사본을 가져와 실행할 수 있습니다.

종속 항목

ZEEK 3.0 이상

설치

Zeek 종속 항목 설치


sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev

저장소를 /opt에 클론합니다.

cd /opt
git clone --recursive https://github.com/zeek/zeek
./configure && make && sudo make install

Zeek 설치


./configure && make && sudo make install

위협 인텔리전스 피드 설치

저장소를 /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds에 클론합니다.

cd /opt
git clone https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds.git /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds
echo "@load Zeek-Intelligence-Feeds" >> /usr/local/zeek/share/zeek/site/local.zeek

사용법

/usr/local/zeek/bin/으로 이동합니다.

./zeekctl deploy

업데이트 예약

간단한 bash 스크립트를 업데이트에 사용할 수 있습니다. 예시는 아래와 같습니다.

vi /opt/zeek_update.sh

다음을 추가합니다:

#!/bin/sh
cd /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds && git fetch origin master
git reset --hard FETCH_HEAD
git clean -df

스크립트를 실행 가능하게 만듭니다.

chmod +x /opt/zeek_update.sh

24시간 업데이트를 위해 다음 cron 항목을 추가합니다.

5 * * * * sh /opt/zeek_update.sh >/dev/null 2>&1

로그는 다음 위치에 기록됩니다:

/usr/local/zeek/logs/current/intel.log

소스:

Amnesty_NSO_Domains.intel	Amnesty NSO Domains	https://github.com/AmnestyTech/investigations	https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso	정의되지 않음
abuse-ch-ipblocklist.intel	Abuse.CH Blacklist	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/	https://sslbl.abuse.ch/blacklist/
abuse-ch-malware.intel	Abuse.CH Malware	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/	https://bazaar.abuse.ch/
abuse-ch-threatfox-ip.intel	Abuse.CH ThreatFox	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/	https://threatfox.abuse.ch/
abuse-ch-urlhaus.intel	Abuse.CH URLHaus	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/	https://urlhaus.abuse.ch/
alienvault.intel	AlienVault	https://www.alienvault.com/	http://reputation.alienvault.com/reputation.data	https://otx.alienvault.com/
binarydefense.intel	Binary Defense	https://www.binarydefense.com/	https://www.binarydefense.com/banlist.txt	https://www.binarydefense.com/
censys.intel	Censys	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cobaltstrike_ips.intel	CobaltStrike IP	https://threatview.io/	https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt	https://threatview.io/
compromised-ips.intel	Emerging Threats	https://rules.emergingthreats.net/	https://rules.emergingthreats.net/blockrules/compromised-ips.txt	https://rules.emergingthreats.net/OPEN_download_instructions.html
cps-collected-iocs.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_domain.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
cps_cobaltstrike_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
ellio.intel	Ellio Tech	https://www.ellio.tech	https://www.ellio.tech	https://www.ellio.tech
fangxiao.intel	Cyjax	https://www.cyjax.com/	https://www.cyjax.com/app/uploads/2022/11/fangxiao-a-chinese-threat-actor.txt	https://www.cyjax.com/2022/11/14/fangxiao-a-chinese-threat-actor/
filetransferportals.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
illuminate.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
inversion.intel	Google / Inversion	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists	Github	https://github.com/elliotwutingfeng/Inversion-DNSBL-Blocklists/blob/main/LICENSE
lockbit_ip.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
log4j_ip.intel	다중 소스	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
openphish.intel	OpenPhish	https://openphish.com	https://openphish.com/feed.txt	https://openphish.com/terms.html
predict_intel.intel	조지아 공과대학교 연구소 (GTRI)	https://www.gatech.edu/	https://www.gatech.edu/	https://www.gatech.edu/
ragnar.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
sans.intel	SANS	https://isc.sans.edu/	https://isc.sans.edu/api/intelfeed	https://isc.sans.edu/data/threatfeed.html
scumbots.intel	ScumBots	없음	없음	Paul Melson의 허가 - 무료 사용
stalkerware.intel	Critical Path Security	https://www.criticalpathsecurity.com/	Github	https://www.criticalpathsecurity.com/
tor-exit.intel	Tor 프로젝트	https://www.torproject.org/	https://check.torproject.org/exit-addresses	https://www.torproject.org/
Mon Aug 3 21:02:33 UTC 2026

Zeek-Intelligence-Feeds

인기

Zeek Intel 위협 피드 (통합 지표 포함)

시작하기

종속 항목

설치

위협 인텔리전스 피드 설치

사용법

업데이트 예약