Posted by malvuln on Jan 05
SigInt-Hombre, generates derived Suricata detection rules from live
URLhaus threat indicators at runtime and deploy them to the Security
Onion platform for high-coverage real-time network monitoring.
https://github.com/malvuln/sigint-hombre
What it does:
Pulls the public URLhaus feed in real time (not mirrored or redistributed)
Skips:
Comments, empty lines, malformed URLs, and feed self-references
Normalizes and extracts:
Protocol, host, URI…
– Read More – Full Disclosure
