iocingestor

An extendable tool to extract and aggregate IoCs from threat feeds.

This tool is a forked version of InQuest's ThreatIngestor focuses on MISP integration.

Key differences

• Better MISP integration.
  • Working with the latest version of MISP.
  • Smart event management based on reference_link.
• MISP warninglist compatible whitelisting.
• Using ioc-finder instead of iocextract for IoC extraction.
  • YARA rule extraction is dropped.

Installation

iocingestor requires Python 3.6+.

Install iocingestor from PyPI:

pip install iocingestor

Usage

Create a new config.yml file, and configure each source and operator module you want to use. (See config.example.yml as a reference.)

iocingestor config.yml

By default, it will run forever, polling each configured source every 15 minutes.

Plugins

iocingestor uses a plugin architecture with "source" (input) and "operator" (output) plugins. The currently supported integrations are:

Sources

• GitHub repository search
• RSS feeds
• Twitter
• Generic web pages

Operators

• CSV files
• MISP
• SQLite database