Add more Lookup providers and file hashes

[graylog2]

Add more Lookup providers and file hashes

[fulldanad]

Hi Gents,

Sounds good to have a generic lookup feature for log enrichment in particular for otx, virustotal and misp hashes. 👍

Find below some additionnal free sources I'd like to use to enrich my logs with :

http://rules.emergingthreats.net/blockrules
http://rules.emergingthreats.net/fwrules
http://hailataxii.com
https://www.iblocklist.com/lists
http://mirror1.malwaredomains.com
https://www.phishtank.com/
https://isc.sans.edu/suspicious_domains.html

Cheers

[ion-storm]

Basically same features as threat pinch implemented into Graylog threat Intel. Also I'd like to add malware domains lists as well

[lennartkoopmann]

We'll start looking into this really soon!

[kurobeats]

Emerging threats pulls from hereL

http://www.openbl.org/lists/base.txt

[ion-storm]

I have Graylog parse and add an MD5 field for each file executed on windows systems, can we add MD5 file checking:

OTX already support MD5/SHA256/imphash lookup:
example:
https://otx.alienvault.com/indicator/file/db349b97c37d22f5ea1d1841e3c89eb4

API Examples:
https://otx.alienvault.com/static/external_api.html#panel_api_v1_indicators_file__file_hash___section_

[skear]

VirusTotal file hash lookups would be very useful for use in combination with messages received from sysmon.

[dio99]

how is this going ? will it be added soon ?

[MP-blue]

The current options of TOR, abuse.ch (seems to be discontinued: https://ransomwaretracker.abuse.ch/) and Spamhaus are just not enough these days. AFAIK AlienVault's OTX isn't part of the Threat Intel Plugin any longer.

Additional integrations are badly needed.