TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.
Threat-Intelligence-Hunter
<img alt="Coverity Scan Build Status" src="https://scan.coverity.com/projects/16214/badge.svg"/>
Summary
TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.
Requirements
- Python 2.7
- Argparse
- Requests
- API keys from Virustotal and URLVoid
you can run the following command to install all the required packages in a go.
pip install -r requirements.txtFeatures
- Local storage of threat feeds
This allows you to regularly update your local storage from listed feeds under feeds.py. You can add your own favourite list if it is missing from the list.
python tih.py -update- Check an IP against existing threat feeds and your local database
python tih.py -ip <IP Address to lookup>- check for Bulk IP address list(in a text file)
python tih.py -list <file.txt>- Check for MD5 Hash
python tih.py -md5 <hash>- Check URL for blacklisting
python tih.py -url <your_url>- Check for IP/URL reputation (Currently supports URLVoid and Virustotal)
Before using this feature, make sure you have added your public keys for URLVoid and VT to
urlvoid.pyandvt.pyrespectively.
python tih.py -repo <URL/IP>Final Version -> Darklord
No more limits. Keep adding your updates and changes
Previous Version -> Bellatrix Lestrange
This version will have a more organized output and search mechanism.
Current version -> Peter Pettigrew v0.8
This version adds support for local storage of feeds.
Previous versions ->
Rita Skeeter v0.6
This version will have support for domains as indicators.
Lucious Malfoy v0.4
This version will have support for MD5 as Commandline input as well as a list inside a TXT file.
Draco Malfoy v0.2.
Now supports a list of IP addresses as indicators. Supports Single or multiple IPs as commandline arguments and parses it against a list of indicators.