Threat Intel

Threat intel

SIEMLite checks every event against a list of indicators: IP addresses, CIDR ranges, domains (which also match subdomains) and MD5/SHA-1/SHA-256 hashes. It looks at the source and destination IPs and at IPv4 addresses, domain names and hashes anywhere in the raw log. A hit marks the event as a threat (red bar and INTEL badge in the UI, threat=true in search) and records which indicator, source and field matched.

Download feeds automatically (refreshed every -intel-refresh, default 6h):

./siemlite \
  -intel-feed feodo=https://feodotracker.abuse.ch/downloads/ipblocklist.txt \
  -intel-feed drop=https://www.spamhaus.org/drop/drop.txt \
  -intel-feed urlhaus=https://urlhaus.abuse.ch/downloads/hostfile/

Or manage indicators from the command line (works while the server is running; changes are picked up within 30s):

./siemlite intel import -source mylist -file iocs.txt     # replaces everything in "mylist"; -file - reads stdin
./siemlite intel import -source feodo -url https://feodotracker.abuse.ch/downloads/ipblocklist.txt
./siemlite intel add -source manual -value 203.0.113.7 -description "seen in phishing"
./siemlite intel list
./siemlite intel delete -source mylist

Feed files have one indicator per line. Plain lists, CSV (first column), Spamhaus DROP (1.2.3.0/24 ; SBL123), hosts files (0.0.0.0 evil.example) and URL lists (the host is used) are understood; comments and invalid lines are skipped. The type is detected, or forced with -type ip|cidr|domain|hash. Importing or refreshing a source replaces all of its indicators, so entries removed from a feed stop matching. A download that fails or comes back empty keeps the previous indicators.

Matching happens when an event is stored; adding an indicator does not flag older events (search for it instead).