ThreatIngestor
An extendable Python tool to extract and aggregate Indicators of Compromise (IOCs) from various threat intelligence feeds.
What is ThreatIngestor?
ThreatIngestor is an open-source Python tool that automates the extraction and aggregation of Indicators of Compromise (IOCs) from various online threat intelligence feeds. It monitors sources like Twitter, RSS feeds, and web pages to collect malicious IPs, domains, and YARA signatures, then forwards them to security analysis platforms. The tool helps security teams efficiently gather and process threat data to improve their defensive posture.
Security analysts, threat intelligence teams, and SOC (Security Operations Center) personnel who need to automate the collection and aggregation of threat indicators from diverse online sources.
Developers choose ThreatIngestor for its extensible plugin architecture, which allows seamless integration with existing workflows and tools like MISP and ThreatKB. Its ability to handle multiple input sources and output destinations, combined with continuous polling, makes it a flexible and powerful solution for threat intelligence automation.
Overview
Extract and aggregate threat intelligence.
Use Cases
Best For
- Automating IOC collection from security blogs via RSS feeds
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
