kaptan/enriocher
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
The IoC Enrichment API is a Python app that analyzes IoCs using threat intelligence services.
2 commits 1 branch 0 tags 72 KiB
  • Python 97.8%
  • Dockerfile 2.2%
Find a file
Exact
Kaptan 50d460da10
 Create LICENSE 
Add AGPL license
2023-08-17 12:03:21 +03:00
app Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00
docker-compose.yml Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00
Dockerfile Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00
LICENSE Create LICENSE 2023-08-17 12:03:21 +03:00
poetry.lock Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00
pyproject.toml Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00
README.md Initial commit: Set up basic project structure and functionalities 2023-08-15 11:16:54 +03:00

README.md

EnrIoCher

The IoC Enrichment API is a Python application that provides enrichment and analysis for Indicators of Compromise (IoCs) using various threat intelligence services. It allows users to query and analyze different IoC types and receive relevant information about their potential malicious activities.

Features

  • Enrichment of various IoC types, with domain names.
  • Integration with multiple threat intelligence services, such as VirusTotal, AbuseIPDB, Censys, URLScan, and more.
  • Caching mechanism to improve response times for frequently queried IoCs.
  • Data storage and retrieval using a PostgreSQL database for historical analysis.
  • Easy-to-use API endpoints for querying and retrieving IoC analysis results.

Getting Started

Follow these steps to set up the IoC Enrichment API on your local machine:

  1. Install Docker and Docker Compose on your system.
  2. Clone this repository to your local machine using the following command:
git clone https://github.com/c4pt-mqs/enriocher.git
  1. Navigate to the project directory:
cd enriocher/
  1. If you want to execute in your local machine using any of the following commands:
python3 main.py
uvicorn main:app --reload
  1. Build and run the Docker containers:
docker-compose up --build -d
  1. Once the containers are up and running, you can access the API at http://localhost:8000.

API Endpoints

  • GET /: Returns a simple message to verify that the server is running.
  • GET /search?ioc_value=<IOC_VALUE>: Performs analysis for the provided IoC value. Replace <IOC_VALUE> with the domain you want to analyze.

Configuration

You can configure the API settings by modifying the settings.toml file in the app/config directory. This file contains API host, port, and API keys for various threat intelligence services.