Criminal IP TI Feed

Criminal IP TI Feed matches the Criminal IP threat intelligence feed against your firewall traffic logs and shows which of your assets communicated with malicious IPs. 🔎 The app: - Downloads the feed every 3 hours - Correlates it with FortiGate traffic logs (Palo Alto Networks PAN-OS and Cisco ASA through adapter macros) - Writes matches to a summary index - Sends Slack alerts grouped by malicious IP and direction, with a line for each asset - Includes dashboards for SOC triage: Overview, Investigate, All detections, IP lookup, Trends, Alerts and Health 🚨 Severity is based on the session outcome in the firewall log. A contact with no completed session is graded watch at most, and critical means one of your assets connected to a malicious IP and received a response. ☑️ Requires a Criminal IP TI Feed License (API Key) and self-managed Splunk Enterprise on Linux. 🔔 A Slack incoming webhook is needed only for Slack alerts.