Christoffer S.Mar 5

Could I please request some advice from my fellow cybersecurity people. I'm thinking of putting together a public feed of IOCs from public OSINT-reporting.

I've already got everything setup, but I'm not sure if this would be considered... a little bit too much of a scraping activity.

Would it be appreciated, or frowned upon?

#Cybersecurity #ThreatIntel

Show threadCali
@nopatience appreciated.. what are the sources?
Mar 5 at 7:22amWeb
Show threadChristoffer S.Mar 5

@Cali Sources are "primary", i.e. articles/blogposts by companies like Mandiant, CrowdStrike, CloudSek, Huntress, etc etc.

There are 351 such sources that I'm pulling from.

I'm not entirely sure about the format either. Because I'm guessing that some would probably prefer to get it machine readable, but others may want to know from where a specific IOC came from.

Ideally it should probably be provided in some sort of TAXII/STIX feed thingy.

But I also don't want to make it too complicated. A continuously updated CSV might be alright... or just a JSON populated with new entries.

Show threadCali4d ago
@nopatience that sounds great tbh.. low “barrier to entry” for smaller orgs as well
Show threadChristoffer S.Mar 5
@Cali I'm also thinking of possibly not just providing a list of IOCs, but rather a contextually rich list with a bit more information about the IOC in question.