search

InQuest / ThreatIngestor

Extract and aggregate threat intelligence.
https://inquest.readthedocs.io/projects/threatingestor/
GNU General Public License v2.0
821 stars 135 forks source link

API Key ThreatKB ? #70

Closed a88xss closed 5 years ago

a88xss commented 5 years ago

Hi Inquest team, I would like to have more clarity on how I can obtain the Key API from threatKB and be able to complete the installation of ThreatIngestor and process data. I would like to know if the tool allows me to process information with twitter and rss sources without this API key.

Regards

needmorecowbell commented 5 years ago

Hello! The ThreatKB API key is obtained from the ThreatKB interface after installing it on your machine. It is only necessary if you plan on putting in the ingested artifacts into ThreatKB. You can put the information into any of the operator plugins, only one is required. The simplest example is csv -- you could just pipe all new artifacts into a csv file, and read them from there. Personally, I find the sqlite operator plugin matched with the hug server to be the quickest way to get set up, since it doesn't require any keys for the operators, and you have a ui where you can view all of your sourced artifacts. There are instructions on how to do this available in our documentation.

https://threatingestor.readthedocs.io/en/latest/welcome.html#try-it-out