Criminal IP TI Feed

Criminal IP TI Feed matches Criminal IP's threat intelligence feed against your firewall traffic logs and shows which of your assets actually communicated with malicious IPs. 🔎 The app: - Downloads the feed every 3 hours - Correlates it with FortiGate traffic logs (Palo Alto Networks PAN-OS and Cisco ASA/FTD via field-mapping macros) - Writes findings to a summary index - Sends rolled-up Slack alerts (a section per malicious IP and direction, with per-asset detail) - Ships SOC dashboards for triage: Overview, Investigate, All detections, IP lookup, Trends, Alerts and Health 🚨 Severity is grounded in what actually happened on the wire: contacts that never completed a session cannot exceed the watch tier, so critical means a session really opened. ☑️ Requires a Criminal IP TI Feed License (API Key) and self-managed Splunk Enterprise on Linux. 🔔 A Slack incoming webhook is optional for alerting.