ThreatLens

ThreatLens is an advanced command-line interface (CLI) tool designed to streamline the analysis of Indicators of Compromise (IOCs) such as IPs, domains, file hashes, and CVEs from multiple trusted threat intelligence sources. Using ThreatLens, analysts can simultaneously query up to six free threat intelligence APIs including VirusTotal, Shodan, AbuseIPDB, and more, significantly reducing the time spent switching between different platforms.

Key Features:

• Multi-Source Queries: Submit multiple IOCs in a single command to receive consolidated insights rather than navigating through various websites.
• Rapid IOC Investigation: Quickly assess threats across comprehensive data points, leading to informed decisions in SOC operations and incident response.
• Rich Output Formats: Generate easy-to-read reports in various formats (Excel, JSON, CSV) that are color-coded for clarity and better data interpretation.
• Integrated API Support: Leverages trusted APIs to enhance accuracy and depth of intelligence, allowing for enhanced threat monitoring.
• Automatic IOC Extraction: Effortlessly pull out IOCs from raw logs, aiding in quick investigations without manual effort.
• Local Cache: Utilizing SQLite for local caching allows for faster repeated lookups and reduces dependency on live API interactions.
• Privacy Controls: With modes that limit external requests, potentially sensitive data is safeguarded during analysis.
• Modular Architecture: Built for extensibility, enabling the addition of new sources with minimal changes to existing code.

Example Usage:

This tool allows for flexible usage such as investigating an IP address:

python main.py -i 45.33.32.156

For comprehensive investigations involving multiple types of IOCs, ThreatLens supports concatenation:

python main.py -i 45.33.32.156 -d malware.example.com -s d41d8cd98f00b204e9800998ecf8427e -c CVE-2021-44228

Ideal for:

ThreatLens is particularly beneficial for Security Operations Center (SOC) analysts, incident responders, and threat hunters who require swift, reliable, and detailed IOC enrichment from command-line tools without compromising on insight quality.

This tool is designed to operate entirely within the bounds of free API usage, ensuring that analysts can harness powerful threat intelligence capabilities without incurring costs, while a request budget cap protects against potential abuse of API limits.

Whether used for a simple IOC query or for comprehensive threat analysis spanning numerous entities, ThreatLens stands as a vital asset in the arsenal of modern cybersecurity professionals.