Spiritbox

Spiritbox is a PowerShell module and Graphical User Interface (GUI) for sending Indicators of Compromise (IOCs) to Elastic.

Below is an example of the JSON documents created by Spiritbox. The fields may change or grow.

{
  "event": {
    "kind": "enrichment",
    "category": "threat",
    "type": "indicator"
  },
  "geo.name": "Ziwa",
  "observer": {
    "type": "Firewall"
  },
  "threat": {
    "marking": {
      "tlp": "GREEN"
    },
    "feed": {
      "name": "Spiritbox",
      "reference": "https://github.com/cyberphor/Spiritbox"
    },
    "tactic": {
      "name": "Reconnaissance"
    },
    "indicator":  {
      "provider": "Weyland-Yutani Corp",
      "last_seen": "2023-03-16T06:38:49.000Z",
      "ip": [
        "1.2.3.4",
        "2.2.2.2",
        "192.168.1.23"
      ],
      "type":  [
        "ipv4-addr"
      ]
    },
    "response": "None"
  }
}

Screenshots

Input Validation

Progress Bar

Progress Bar Error

Copyright

This project is licensed under the terms of the MIT license. The ghost icon was created by Freepik (Flaticon).