Graylog2 / Graylog2/graylog-plugin-threatintel

Add more Lookup providers and file hashes

Open
#25 8 comments 5 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
158
Forks
18
PR merge metrics
No merged PRs in 30d

Description

Please add the following IOC's and lookups, I'd like to use Sysmon Hash checks as well:
IPv4
MD5
SHA1
SHA256
CVE
FQDN (EFQDN is for Internet FQDN, IFQDN is for internal domains)

ThreatMiner for IPv4, FQDN, MD5, SHA1 and SHA2 lookups.
Alienvault OTX for IPv4, MD5, SHA1 and SHA2 lookups.
IBM X-Force Exchange for IPv4, EFQDN lookups.
VirusTotal for MD5, SHA1, SHA2 and FQDN lookups.
Cymon.io for IPv4 lookups.
CIRCL (Computer Incident Response Center Luxembourg) for CVE lookups.
PassiveTotal for FQDN Whois lookups
MISP for MD5 and SHA2 (If you want more submit an issue in this github)
Censys.io for IPv4 lookups
Shodan for IPV4 lookups

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.