search

DefensePointSecurity / threat_note

DPS' Lightweight Investigation Notebook
Apache License 2.0
421 stars 97 forks source link

Integrating IOC-Parser type capability #146

Open mtaylor2015 opened 8 years ago

mtaylor2015 commented 8 years ago

Something that I have been working in regards to a similar system is to integrate a Intelligence report parser that would add the indicators out of the report into the system. Any thoughts on this?

brianwarehime commented 8 years ago

That would definitely be a good idea to add in. Once I get back into development mode, I'll revisit this and hopefully integrate it. Thanks for the idea!

swannysec commented 8 years ago

@sroberts and I have been batting around the idea of using one or both of his tools, Cacador and Jager. Unfortunately, I don't know jack, so he'd have to comment on the possibilities. Definitely think this capability would be an excellent inclusion.

sroberts commented 8 years ago

It's certainly possible, it just introduces a lot of complexity and a semi different set of use cases. I built the API subsystem to get around much of this.