Skip to content

ThreatCull 2.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 04:51
· 82 commits to dev since this release
v2.5.0
ab64b62
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ThreatCull now warns about Sources whose list stopped changing, and the Catalog gains eight Sources.
Nothing to do when upgrading: database migration 11 runs on start and dates each Source's last change
from the newest entry it added. Use Check for updates on the Sources page to get Catalog revision 4
on an existing install.

Added

  • 🆕 Eight new Catalog Sources, all disabled until you enable them. IP blocklists: Binary
    Defense Artillery ban list (binarydefense-banlist), ThreatCluster IPs (threatcluster-ips) and
    SiberKapan honeypot IPs (siberkapan-ips). Domain blocklists: abuse.ch ThreatFox
    (threatfox-hostfile), C2IntelFeeds C2 domains (c2intelfeeds-domain-30d), ThreatView
    high-confidence domains (threatview-domain-high), ThreatCluster domains
    (threatcluster-domains) and SiberKapan phishing domains (siberkapan-domains).
  • 🧊 Frozen Sources. ThreatCull records when each Source's list last gained or lost an entry and
    marks an enabled blocklist Source frozen when that is 30 or more days ago
    (frozen_after_days). The Sources page shows "changed 4 months ago" for every Source and has a
    Frozen filter, the dashboard counts frozen Sources, /api/v1/sources returns last_changed_at and
    frozen, and threatcull sources list prints both. Frozen Sources still count towards scores.
    After the upgrade, the change date starts from the newest entry each Source added.
    #84

Changed

  • 👪 Source Families for C2IntelFeeds and ThreatView. The IP and domain Sources from each
    publisher now share a Family (c2intelfeeds, threatview), so together they count once towards
    a Confidence Score.
Assets 2
Loading