Repository of scrips to add AlienVault's OTX intel feed to zeek
The scripts works with a (free) API key from AlienVault's OTX feed. Obtain a key by signing up for the OTX service here: https://otx.alienvault.com/
The zeek-otx.py script can be run independently, or to install on a SecurityOnion 2 machine:
git clone https://github.com/SackOfHacks/zeek-otx.git
cd zeek-otx
chmod +x install-so2.sh
sudo ./install-so2.sh
After initial install it might take a few minutes for Zeek to start using the intel feed. You can monitor results with the following command:
tail -f /nsm/zeek/logs/current/intel.log
(example output for running a nslookup on "w0x.host"):
...
{"ts":"2020-11-25T21:55:18.492845Z","uid":"CAQ5L829XWjptOiFF4","id.orig_h":"172.16.25.123","id.orig_p":58219,"id.resp_h":"9.9.9.9","id.resp_p":53,"seen.indicator":"w0x.host","seen.indicator_type":"Intel::DOMAIN","seen.where":"DNS::IN_REQUEST","seen.node":"zeek","matched":["Intel::DOMAIN"],"sources":["AlienVault OTXv2 - Luhansk Ukraine Gov. Phishing Campaign ID: 5fb83d70906bd27194456779 Author: AlienVault"]}
...