I have added a tiny feature on https://threat.cstromblad.com to highlight "breaking stories" in an attempt to surface things such as the Axios attack.

It's not perfect but not bad either as a first attempt. Recent articles within the last 24-48 hours and with spiking tag clusters. First version, will tweak.

Will fix the mobile version that kinda sucks right now, apologies for that.

#ThreatIntel

Threat Landscape — ORLYSEC Cyber

@nopatience This is a really cool website, thank you. I have it open in a tab and check it once a day to see if I missed something important.

Do you share the list of sources that you are using for this anywhere?

@hacksilon
First of all, thank you, happy you find it useful.

Please don't hesitate to let me know if you miss something. I run a cronjob about twice a day, and sometimes run it manually to update the caches.

Regarding sources, no, I dont. But I guess I could expose a little extra tab/menu item with some appropriate level of data for the sources used.

Will fix later today!

@hacksilon
PS: the Archetype classifier has recently been improved and I don't reclassify articles, takes too much time.

But the "detailed analysis" section should improve over time and give a better idea of the judged "end goal" of an event/incident/article.

@nopatience Great, thanks for the quick response. I am currently setting up a similar system (monitoring for relevant advisories etc.) and am looking for sources to ingest, so seeing which ones you are working with, in addition to the ones I am using myself, will be quite helpful. :)

@hacksilon I think the total is around 360 ish... but I have started another round of qualifying and verifying which sources have gone stale.

It's a tedious but oh so important process to ensure the quality going into the processing system as a whole.

When you say advisories, is there anything in particular you're looking for? I would be curious to see if I already potentially have what you're looking for.

Out of pure curiosity.

@nopatience Mostly looking at supply chain attacks right now, so stuff like trivy, axios, etc. - current sources are Socket.dev, OpenSourceMalware, OX Security, Aikido, StepSecurity, Huntress. Goal is to know about a supply chain attack as quickly as possible, so we can start incident response and countermeasures in our project. Logical next step would be sources for critical CVEs in JS and Java ecosystem, but one thing at a time. :)
@hacksilon And when you say supply chain you are mostly (100%) referring to the software supply chain ecosystem, right?
@nopatience as opposed to chips and crude oil? Yes.

@hacksilon haha... I was thinking... "supply chain" as in organizational supply chains, third party etc.

But gotcha. Let me explore a little bit what sort of data I have available, and the sources for that.

@hacksilon Were you thinking something like this?
@nopatience yep, that looks like the sorts of sources I am looking for 👍