Mihari is a framework for continuous OSINT based threat hunting.
- Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc. and extracts artifacts (IP addresses, domains, URLs or hashes).
- Mihari checks whether the database (SQLite3, PostgreSQL or MySQL) contains the artifacts or not.
- If it doesn't contain the artifacts:
- Mihari saves artifacts in the database.
- Mihari creates an alert on TheHive.
- Mihari sends a notification to Slack.
- Mihari creates an event on MISP.
- If it doesn't contain the artifacts:
Also, you can check the alerts on a built-in web app.
Mihari supports the following services by default.
- BinaryEdge
- Censys
- CIRCL passive DNS / passive SSL
- crt.sh
- DN Pedia
- dnstwister
- Onyphe
- OTX
- PassiveTotal
- Pulsedive
- SecurityTrails
- Shodan
- Spyse
- urlscan.io
- VirusTotal & VirusTotal Intelligence
- ZoomEye
The gem is available as open source under the terms of the MIT License.
Mihari is proudly supported by Tines.io, The SOAR Platform for Enterprise Security Teams.