The list below provides a list of open source threat feeds that are available for security professionals and the community at large. The expectations for threat intelligence sources are as follows:
reputable
high quality
accurate
timely
Below is a sampling of open source threat feeds.
The Open Threat Exchange, a cooperative platform where users can share and access threat intelligence, including details on malicious IP addresses, domains, and more, is provided by AlienVault, which is now a part of AT&T Cybersecurity.
ET Open is a free and open-source project that collects network security threats and guidelines. It is compatible with a wide range of intrusion detection systems (IDS) and intrusion prevention systems (IPS).
A worldwide non-profit group that collects open-source threat intelligence about network security and honeypots. They exchange tools and research on identifying and reducing security risks.
URLhaus is a community-driven effort that gathers and disseminates data regarding rogue URLs and domain names. For accessing their dataset of known harmful URLs, they offer an API.
The goal of MISP, an open-source threat intelligence platform, is to enhance the exchange of organized threat data. It makes data on threats and attacks easier for organizations to gather, exchange, and correlate.
SANS ISC provides a variety of cybersecurity resources, such as daily diaries and threat feeds. They provide information on the most recent security threats and vulnerabilities.
PacketTotal is a network traffic analysis-focused open-source threat intelligence platform. Users can upload and analyze packet captures in order to detect suspicious or malicious activity.
PhishTank is a collaborative platform that gathers and distributes data on phishing attacks and malicious websites. They provide an API for data access.