IRIS — Threat Intelligence Correlator & Alert Engine

IRIS is an automated threat intelligence aggregation, correlation, and alerting platform built for red teams and security operations. It pulls from 8+ industry TI feeds, cross-references indicators against your target scope, correlates findings across sources, and generates actionable alerts.

---

Features

• Multi-Feed Aggregation — VirusTotal, Shodan, AbuseIPDB, URLhaus, abuse.ch, Phishtank, Tor Exit Nodes, Censys
• Correlation Engine — detect shared ASNs, registrants, infrastructure across feeds; confidence-scored results
• Continuous Monitoring — watch targets in the background; alert on new findings
• Historical Database — SQLite (default) or PostgreSQL; full indicator history and trend analysis
• Rich CLI — colorized output, tables, progress bars
• Multi-Channel Alerting — Email, Slack, Discord, syslog
• Web Dashboard — optional browser UI for real-time feed status, alerts, correlation visualization
• Flexible Scope — JSON/YAML scope files with IPs, CIDRs, domains, hashes

---

Installation

git clone https://github.com/xdrew87/iris.git
cd iris
pip install -r requirements.txt

---

Quick Start

# Initialize your workspace (creates config.yaml)
python src/main.py init

# Scan a single indicator
python src/main.py scan 1.2.3.4
python src/main.py scan malware.example.com
python src/main.py scan d41d8cd98f00b204e9800998ecf8427e

# Correlate a scope file
python src/main.py correlate --scope scope.json

# Watch targets continuously
python src/main.py watch --scope scope.json

# Generate a report
python src/main.py report --format json --output report.json

# Launch web dashboard
python src/main.py dashboard --port 8080

---

Configuration

Copy config.yaml and fill in your API keys — or set them as environment variables (recommended):

Feed	Environment Variable
VirusTotal	IRIS_VT_API_KEY
Shodan	IRIS_SHODAN_API_KEY
AbuseIPDB	IRIS_ABUSEIPDB_API_KEY
Censys	IRIS_CENSYS_API_ID + IRIS_CENSYS_API_SECRET
Slack Alert	IRIS_SLACK_WEBHOOK
Discord	IRIS_DISCORD_WEBHOOK

URLhaus, abuse.ch, Phishtank, and Tor exit nodes require no API key.

---

Scope File Format

{
  "targets": [
    {"type": "ip",     "value": "1.2.3.4",                              "label": "C2 Server"},
    {"type": "domain", "value": "evil.example.com"},
    {"type": "hash",   "value": "d41d8cd98f00b204e9800998ecf8427e",     "label": "Malware Sample"}
  ]
}

---

Output Example

╔══════════════════════════════════════════════╗
║        IRIS Threat Intelligence Report        ║
╚══════════════════════════════════════════════╝

Target: 1.2.3.4
─────────────────────────────────────────────
 Feed          Status     Confidence  Flags
 VirusTotal    MALICIOUS  92%         Malware C2
 AbuseIPDB     MALICIOUS  87%         SSH Brute Force
 Shodan        INFO       —           Port 22,80,443
 Tor Exit      FLAGGED    100%        Known Exit Node

 Correlation: AbuseIPDB + VirusTotal = Same ASN AS12345
 Overall Confidence: 89% — HIGH RISK

---

Docker

docker-compose up

---

Contributing

See CONTRIBUTING.md.

Security

See SECURITY.md to report vulnerabilities.

License

MIT © 2026 xdrew87