hslatman/awesome-threat-intelligence

★ 10,191Audience · developerComplexity · 1/5Setup · easy

Mindmap

mindmap
  root((awesome-threat-intel))
    What it is
      Curated reference list
      Community maintained
    Data Sources
      IP blocklists
      Malware feeds
      Phishing domains
    Tools and Platforms
      Threat management
      Analysis tools
    Use Cases
      Firewall integration
      Incident response
    Audience
      Security analysts
      Network defenders

mindmap root((awesome-threat-intel)) What it is Curated reference list Community maintained Data Sources IP blocklists Malware feeds Phishing domains Tools and Platforms Threat management Analysis tools Use Cases Firewall integration Incident response Audience Security analysts Network defenders

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Find free IP blocklists and malicious domain feeds to plug into your firewall or intrusion detection system.

USE CASE 2

Discover platforms for correlating and managing threat data across your security tools.

USE CASE 3

Research which organizations publish threat intelligence feeds relevant to your industry.

USE CASE 4

Identify analysis tools for investigating malware samples and phishing campaigns.

Getting it running

Difficulty · easy Time to first run · 5min

No license information is mentioned in the explanation.

In plain English

This repository is a curated reference list for people working in cybersecurity who want to track threats, malicious activity, and attack patterns on the internet. Threat intelligence, as the project defines it, is evidence-based knowledge about existing or emerging dangers to computer systems, including context about who is behind them, how they work, and what to do about them. The list is organized into several categories: sources of raw threat data (like feeds of known bad IP addresses, malware hashes, and suspicious domains), data formats used to share threat information, platforms and frameworks for managing and correlating threat data, standalone tools for analysis, and research papers and standards documents. The sources section alone covers dozens of services, including community-driven blocklists, commercial feeds with free tiers, real-time certificate transparency streams, and databases of known malicious IP addresses. Some of these are freely available to anyone, while others require registration or a license for commercial use. Examples include AbuseIPDB for reporting and looking up bad IP addresses, CrowdSec for crowd-sourced attack detection, and feeds from organizations like Cisco and various security research groups. This is not a software project you install or run. It is a reference document, maintained on GitHub and open for community contributions. Security analysts, incident responders, and network defenders use lists like this to find data sources they can feed into their own monitoring tools, firewalls, or threat detection systems. If you are new to security and find the terminology unfamiliar, the scope here is broad: everything from tracking botnets to monitoring phishing domains to analyzing malware certificates. The list has grown large over time, and the full document is substantially longer than the excerpt shown here. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

I need to block known malicious IPs in my firewall. Based on awesome-threat-intelligence, which free feeds should I use and how do I pull them automatically?

Prompt 2

Using the sources in hslatman/awesome-threat-intelligence, help me write a Python script that fetches the AbuseIPDB blocklist and adds the IPs to my iptables rules.

Prompt 3

I'm building a threat detection system. Based on awesome-threat-intelligence, what data formats like STIX or TAXII should I support, and how do I parse them?

Prompt 4

Help me set up a daily cron job that downloads multiple threat intel feeds listed in awesome-threat-intelligence and deduplicates them into a single blocklist file.

Open on GitHub → Explain another repo

← hslatman on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.