IntelMQ is a solution for CERTs to process data feeds, pastebins, tweets throught a message queue.
Project description
Welcome to IntelMQ!
.. figure:: https://raw.githubusercontent.com/certtools/intelmq/master/docs/images/Logo_Intel_MQ.png
:alt: IntelMQ
IntelMQ
|Build Status| |Coverage Status| |codecov.io|
**IntelMQ** is a solution for CERTs for collecting and processing
security feeds, pastebins, tweets and log files using a message queuing
protocol. It's a community driven initiative called **IHAP** (Incident
Handling Automation Project) which was conceptually designed by European
CERTs during several InfoSec events. Its main goal is to give to
incident responders an easy way to collect & process threat intelligence
thus improving the incident handling processes of CERTs.
IntelMQ's design was influenced by
`AbuseHelper <https://bitbucket.org/clarifiednetworks/abusehelper>`__,
however it was re-written from scratch and aims at:
- Reduce the complexity of system administration
- Reduce the complexity of writing new bots for new data feeds
- Reduce the probability of events lost in all process with persistence
functionality (even system crash)
- Use and improve the existing Data Harmonization Ontology
- Use JSON format for all messages
- Integration of the existing tools (AbuseHelper, CIF)
- Provide easy way to store data into Log Collectors like
ElasticSearch, Splunk
- Provide easy way to create your own black-lists
- Provide easy communication with other systems via HTTP RESTFUL API
It follows the following basic meta-guidelines:
- Don't break simplicity - KISS
- Keep it open source - forever
- Strive for perfection while keeping a deadline
- Reduce complexity/avoid feature bloat
- Embrace unit testing
- Code readability: test with unexperienced programmers
- Communicate clearly
Table of Contents
-----------------
1. `How to Install <#how-to-install>`__
2. `Developers Guide <#dev-guide>`__
3. `IntelMQ Manager <#control-platform>`__
4. `Incident Handling Automation
Project <#incident-handling-automation-project>`__
5. `Data Harmonization <#data-harmonization>`__
6. `Licence <#licence>`__
## How to Install
See `UserGuide <docs/User-Guide.md>`__.
## Developers Guide
See `Developers Guide <docs/Developers-Guide.md>`__.
## IntelMQ Manager
Check the `tool <https://github.com/certtools/intelmq-manager>`__ and
manage easily IntelMQ system.
## Incident Handling Automation Project
- **URL:**
http://www.enisa.europa.eu/activities/cert/support/incident-handling-automation
- **Mailing-list:** ihap@lists.trusted-introducer.org
## Data Harmonization
IntelMQ use the Data Harmonization. Check the following
`document <docs/Data-Harmonization.md>`__.
## Licence
This software is licensed under GNU Affero General Public License
version 3
.. |Build Status| image:: https://travis-ci.org/certtools/intelmq.svg?branch=master
:target: https://travis-ci.org/certtools/intelmq
.. |Coverage Status| image:: https://coveralls.io/repos/github/certtools/intelmq/badge.svg?branch=master
:target: https://coveralls.io/github/certtools/intelmq?branch=master
.. |codecov.io| image:: https://codecov.io/github/certtools/intelmq/coverage.svg?branch=master
:target: https://codecov.io/github/certtools/intelmq?branch=master
.. figure:: https://raw.githubusercontent.com/certtools/intelmq/master/docs/images/Logo_Intel_MQ.png
:alt: IntelMQ
IntelMQ
|Build Status| |Coverage Status| |codecov.io|
**IntelMQ** is a solution for CERTs for collecting and processing
security feeds, pastebins, tweets and log files using a message queuing
protocol. It's a community driven initiative called **IHAP** (Incident
Handling Automation Project) which was conceptually designed by European
CERTs during several InfoSec events. Its main goal is to give to
incident responders an easy way to collect & process threat intelligence
thus improving the incident handling processes of CERTs.
IntelMQ's design was influenced by
`AbuseHelper <https://bitbucket.org/clarifiednetworks/abusehelper>`__,
however it was re-written from scratch and aims at:
- Reduce the complexity of system administration
- Reduce the complexity of writing new bots for new data feeds
- Reduce the probability of events lost in all process with persistence
functionality (even system crash)
- Use and improve the existing Data Harmonization Ontology
- Use JSON format for all messages
- Integration of the existing tools (AbuseHelper, CIF)
- Provide easy way to store data into Log Collectors like
ElasticSearch, Splunk
- Provide easy way to create your own black-lists
- Provide easy communication with other systems via HTTP RESTFUL API
It follows the following basic meta-guidelines:
- Don't break simplicity - KISS
- Keep it open source - forever
- Strive for perfection while keeping a deadline
- Reduce complexity/avoid feature bloat
- Embrace unit testing
- Code readability: test with unexperienced programmers
- Communicate clearly
Table of Contents
-----------------
1. `How to Install <#how-to-install>`__
2. `Developers Guide <#dev-guide>`__
3. `IntelMQ Manager <#control-platform>`__
4. `Incident Handling Automation
Project <#incident-handling-automation-project>`__
5. `Data Harmonization <#data-harmonization>`__
6. `Licence <#licence>`__
## How to Install
See `UserGuide <docs/User-Guide.md>`__.
## Developers Guide
See `Developers Guide <docs/Developers-Guide.md>`__.
## IntelMQ Manager
Check the `tool <https://github.com/certtools/intelmq-manager>`__ and
manage easily IntelMQ system.
## Incident Handling Automation Project
- **URL:**
http://www.enisa.europa.eu/activities/cert/support/incident-handling-automation
- **Mailing-list:** ihap@lists.trusted-introducer.org
## Data Harmonization
IntelMQ use the Data Harmonization. Check the following
`document <docs/Data-Harmonization.md>`__.
## Licence
This software is licensed under GNU Affero General Public License
version 3
.. |Build Status| image:: https://travis-ci.org/certtools/intelmq.svg?branch=master
:target: https://travis-ci.org/certtools/intelmq
.. |Coverage Status| image:: https://coveralls.io/repos/github/certtools/intelmq/badge.svg?branch=master
:target: https://coveralls.io/github/certtools/intelmq?branch=master
.. |codecov.io| image:: https://codecov.io/github/certtools/intelmq/coverage.svg?branch=master
:target: https://codecov.io/github/certtools/intelmq?branch=master
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distributions
No source distribution files available for this release.See tutorial on generating distribution archives.
Built Distribution
File details
Details for the file intelmq-1.0.0.dev3-py2.py3-none-any.whl.
File metadata
- Download URL: intelmq-1.0.0.dev3-py2.py3-none-any.whl
- Upload date:
- Size: 222.5 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | d24d71cff65d50c9a723c26edd5a859ed8d1d4b835f9b1f6358d8704b8641cef |
|
| MD5 | 1aea4bee5c80e51e649689b587cb95dc |
|
| BLAKE2b-256 | 9499d7895a46ab1d1e7f98a333ac7f2429db339656a532967843841b164af8d7 |
