Enrichment support - Githubissues

matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

https://matano.dev

Apache License 2.0

1.46k stars 100 forks source link

Enrichment support #21

Open Samrose-Ahmed opened 1 year ago

Samrose-Ahmed commented 1 year ago

Tracking issue for enrichment support

Goal

Provide enrichment through enrichment tables in Matano

[x] Enrichment table as Iceberg table
[x] Enrichment tables for lookup in Python detections
[ ] Matching against IOCs
[x] Dynamic & static enrichment tables (ingesting)
[ ] Ingesting threat intelligence feed data (IOC’s)

Managed Integrations

[ ] AbuseCH (Malware Bazaar, Threatfox, URLHaus)
[ ] GeoIP (Maxmind)
[ ] Greynoise intelligence (RIOT, Noise)

Forward looking

[x] #99
[ ] Using enrichment tables in scheduled detections (SQL)
[ ] Auto enrichment (endpoint logs + malware)