>> Hello and welcome to this lesson
about public data sources as
the third type of
external data sources from the data collection module.
Like we've seen in previous videos, in this lesson,
we will discover together the different types of
public data collection sources and how to
choose the best fit to your requirements.
Public threat intelligence sources
are basically available to
anyone and usually with no cost associated with access.
The public data sources are close to
the private ones when it comes to their types,
threat bulletins, feeds, and platforms.
Like we've seen in the video dedicated
to private data collection sources, here,
we're going to see
the threat bulletins or
narrative-based reports, threat feeds,
and threat intelligence platforms that are
publicly available for use.
Public threat intelligence sources
offer huge databases and
concern many types of threats
>> including phishing emails,
>> scanning IPs or crawling IPs,
malware distribution domains, hashes of malwares, etc.
The first problem with
public threat intelligence is
the level of trustworthiness.
Indicators are rarely curated and this can be
serious cause of noise for
teams who are working on generated alerts.
Of course, this could be a problem if you are
willing to ingest free feeds
directly to your some solution.
Another problem with this kind of
intelligence is lack of context.
Some indicators, for example,
IPs, hashes, or domains,
may be mentioned in lists of
feeds and involved with malicious activities,
but they don't provide
full contexts or they don't explain fully their roles.
For example, if they are malware distribution domains,
if their C2 servers or domains are sending spams,
the days of detections,
and if they are targeting particular sector.
These are not the only issues with
public threat intelligence sources because
many sources keep outdated data for years,
which makes validation even harder for analysts.
This is basically the opposite of the goal behind use
an external threat intelligence because it
needs to ensure that you
remain on top of the latest threats.
If the data is old by the time it gets to you,
the indicators may no longer be
associated with malicious activity
and all you would have done is
waste time looking into associated alerts.
Similar to the video where we've
seen private data collection sources,
here with public collection sources
or public threat intelligence sources,
the first type is public finished reports that are
narrative based reports containing
detailed description of incidents and threats.
Here, there are
several vendors and security researcher blogs
who offer free finished reports such as FireEye,
Check Point, Malwarebytes Labs, Trend Micro,
WeLiveSecurity, Securelist,
Talos, Unit 42, etc.
Now, let's move to the second type
of public threat intelligence and I
believe this is
the most common public threat
>> intelligence known source,
>> which is public threat feeds.
Here, we'll start with providing
some examples of platforms and websites
offering this kind of intelligence and
the list that I'm going to
mention is not meant to be exhaustive.
I will start with cybercrime tracker.
This website provides feeds containing URLs and
IPs associated with malicious activity such as Pani,
LuckyBot, Tesla,
etc You can visit
the official website of cybercrime tracker here
mentioned on the slide to find the full list of
indicators that this website is providing.
A second example is URLhaus.
This project is offered by abuse.ch and has
the goal of sharing malicious URLs
that are being used for malware distribution.
Another example of feeds
is offered by Ransomware Tracker.
This platform is dedicated
to track ransomware activities.
Ransomware Tracker is also offered
>> by abuse.ch and tracks
>> and monitor the status of domain names, IP addresses,
and URLs that are associated with
ransomware activity such as botnet C2 servers,
distribution websites, and payment websites.
If you are interested to collect
threat intelligence feeds about phishing,
then OpenPhish is a good source that offers
free feed about phishing campaigns
>> trending on the wide.
>> OpenPhish receives URLs from multiple streams and
analyze them using
their proprietary phishing detection algorithms.
Another public threat intelligence
>> feeds is I-BlockList.
>> I-BlockList maintains several types of lists
containing IP addresses belonging
>> to various categories.
>> Some of these main categories
include a country's ISPs, etc.
Other lists include web attacks
>> or spyware, proxies, etc.
>> Many of these lists are available for
free use and available in various format.
Another example could be
CyberCure platform that offers
free cyber threat intelligence
feeds with lists of IP addresses that
are currently infected and talking on the Internet.
There are lists of URLs used by malware and
lists of hash files of
known malwares that's currently spreading.
You can find the full documentation
available on their official website.
If you think that I mentioned
a lot of examples or large number of
examples and now you are confused
which ones are most appropriate for your use cases,
then I recommend using another type
of threat feeds and particular type of
threat feeds called feed aggregators,
and here, I have two examples.
I will start with the first example
>> which is called LIMO.
>> LIMO is a free feed aggregator offered by
Anomali and LIMO incorporates
intelligence from Anomali Labs,
the Modern Honey Net,
and some other open source feeds from
the mentioned previously and other ones
that I didn't mention in these slides.
LIMO is fully compatible with
sticks and TAXII protocols that we will see in
future videos and to connect LIMO into
a platform called STAXX that we are
going to see in future lessons.
You can use the configuration mentioned in this slide.
The second example of
threat feed aggregator is called Hail a TAXII.
Also, it is compatible with
>> TAXII protocol and it is also
>> a repository of open source threat
intelligence feeds in six format.
You can access or you can collect data from
Hail a TAXII using
the configuration mentioned on this slide.