TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.

#Threat-Intelligence-Hunter

####Summary TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own set of indicators.

Requirements

• Python 2.7
• Argparse
• Requests
• API keys from Virustotal and URLVoid

you can run the following command to install all the required packages in a go.

pip install -r requirements.txt

Features

• Local storage of threat feeds

This allows you to regularly update your local storage from listed feeds under feeds.py. You can add your own favourite list if it is missing from the list.

python tih.py -update

• Check an IP against existing threat feeds and your local database

python tih.py -ip <IP Address to lookup>

• check for Bulk IP address list(in a text file)

python tih.py -list <file.txt>

• Check for MD5 Hash

python tih.py -md5 <hash>

• Check URL for blacklisting

python tih.py -url <your_url>

• Check for IP/URL reputation (Currently supports URLVoid and Virustotal) Before using this feature, make sure you have added your public keys for URLVoid and VT to urlvoid.py and vt.py respectively.

python tih.py -repo <URL/IP>

Final Version -> Darklord

No more limits. Keep adding your updates and changes

Previous Version -> Bellatrix Lestrange

This version will have a more organized output and search mechanism.

Current version -> Peter Pettigrew v0.8

This version adds support for local storage of feeds.

Previous versions ->

Rita Skeeter v0.6

This version will have support for domains as indicators.

Lucious Malfoy v0.4

This version will have support for MD5 as Commandline input as well as a list inside a TXT file.

Draco Malfoy v0.2.

Now supports a list of IP addresses as indicators. Supports Single or multiple IPs as commandline arguments and parses it against a list of indicators.