A Python-based multithreaded threat intelligence gathering tool that collects, stores, and serves indicators of compromise from various sources.
Forager is a multithreaded threat intelligence gathering tool built with Python 3 that collects, stores, and manages indicators of compromise (IOCs) from various sources like threat feeds, PDF reports, and spreadsheets. It solves the problem of aggregating and organizing threat data without requiring complex database infrastructure, making it easy to search and share intelligence. The tool also integrates with security platforms like CarbonBlack by generating and serving JSON feeds.
Security analysts, threat intelligence researchers, and IT security teams who need a lightweight, file-based system for collecting and querying threat indicators without the overhead of enterprise-grade solutions.
Developers choose Forager for its simplicity, modular design, and ease of deployment—it uses plain text files for storage, includes pre-configured feeds, and offers direct integration with CarbonBlack, all while being open-source and customizable.
Multithreaded threat Intelligence gathering built with Python3
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Pulls from 15 pre-configured threat feeds and custom URLs using Python modules, as highlighted in the README, allowing easy updates and customization.
Automatically extracts domains, hashes, IPs, and YARA rules from TXT, PDF, and XLS/XLSX files, streamlining IOC collection from diverse sources.
Generates JSON feeds and runs an HTTP server for automated ingestion, specifically designed for CarbonBlack, enhancing operational efficiency.
Uses TXT files for storage, avoiding complex databases, which makes deployment straightforward and reduces maintenance overhead.
The README admits it's prone to false positives when extracting from PDFs, as whitepapers often contain benign URL references that are incorrectly flagged.
File-based storage in TXT files becomes inefficient for large datasets, lacking the performance, indexing, and querying capabilities of a database.
Primarily integrates with CarbonBlack, offering minimal support for other security platforms or advanced features like correlation and alerting.