Zeek-Intelligence-Feeds - Zeek-Formatted Threat Intelligence Feeds

项目说明

<h1 align="center">


</h1>

Zeek Intel Threat Feed w/ Combined Indicators

This is a public feed based on Public Threat Feeds and CRITICAL PATH SECURITY gathered data.
This feed will be updated as often as possible.

Getting Started

These instructions will get you a copy of the project up and running.

Dependencies

* ZEEK 3.0 or greater

Installing

Install Zeek Dependencies

Clone the repository into /opt

Install Zeek

Install the Threat Intelligence Feeds

Clone the repository into /usr/local/zeek/share/zeek/site/Zeek-Intelligence-Feeds

Usage

Na to /usr/local/zeek/bin/

Scheduling Updates

A simple bash script can be used for updates. An example is shown below.

Add the following:

Make the script executable.

Make the following cron entry for 24 hour updates.

Logs will be written to:

Sources:

Filename | Provider | Homepage | List URL | License/TOU |
|-----------|-----------|----------------------------------|--------------------------------|----------------------------------|
| Amnesty_NSO_Domains.intel | Amnesty NSO Domains | | | Not Defined |
| abuse-ch-ipblocklist.intel | Abuse.CH Blacklist | | | |
| abuse-ch-malware.intel | Abuse.CH Malware | | | |
| abuse-ch-threatfox-ip.intel | Abuse.CH ThreatFox | | | |
| abuse-ch-urlhaus.intel | Abuse.CH URLHaus | | | |
| alienvault.intel | AlienVault | | | |
| binarydefense.intel | Binary Defense | | | |
| censys.intel | Censys | | Github | |
| cobaltstrike_ips.intel | CobaltStrike IP | | | |
| compromised-ips.intel | Emerging Threats | | | |
| cps-collected-iocs.intel | Critical Path Security | | Github | |
| cps_cobaltstrike_domain.intel | Critical Path Security | | Github | |
| cps_cobaltstrike_ip.intel | Critical Path Security | | Github | |
| ellio.intel | Ellio Tech | | | |
| fangxiao.intel | Cyjax | | | |
| filetransferportals.intel | Critical Path Security | | Github | |
| illuminate.intel | Critical Path Security | | Github | |
| in.intel | Google / In | | Github | |
| lockbit_ip.intel | Critical Path Security | | Github | |
| log4j_ip.intel | Multiple Sources | | Github | |
| openphish.intel | OpenPhish | | | |
| predict_intel.intel | Georgia Tech Research Institute (GTRI) | | | |
| ragnar.intel | Critical Path Security | | Github | |
| sans.intel | SANS | | | |
| scumbots.intel | ScumBots | None | None | Permission given by Paul Melson - Free Usage |
| stalkerware.intel | Critical Path Security | | Github | |
| tor-exit.intel | Tor Project | | | |
Mon Oct 5 15:02:42 UTC 2026

项目信息

开发语言：Zeek

Star 数：404

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Zeek-Formatted Threat Intelligence Feeds展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。