3 phút đọc
0xDanielLopez/TweetFeed: TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twit – Repository 0xDanielLopez/TweetFeed. Mô tả: TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes.. 680 stars, 69 forks, ngôn ngữ chính chưa công bố, cập nhật 2026-09-09.
1. Repository làm gì?
Feeds of IOCs posted by the community on Twitter/X
TweetFeed.live | Docs | API | Feedback
The counters below (timestamp, per-type totals, tag count, top tags, top reporters) are regenerated by the pipeline every 15 minutes. Hand-written sections are stable.
If you like the project, please consider:
No header row – the first line is already data, so do not set ignoreFirstRecord / skip_header or you will drop a real IOC. Dates are UTC, tags is space-separated. Live sample: today.csv
Full request/response shapes live in the OpenAPI spec; see tweetfeed.live/agents/ for the copy-paste MCP config and full tool reference.
2. Dữ liệu và cấu trúc đáng chú ý
Top 10 tags (by year activity, refreshed every 15 min)
These are the busiest 10 of 93 tags being matched. Every one of them is queryable through the API and has its own RSS feed; the highest-volume ones also get a curated landing page at tweetfeed.live/tags/.
Search tweets that contain certain tags or that are posted by certain infosec people.
The 10 above are just the busiest. Curated landing pages for the highest-volume tags live at tweetfeed.live/tags/, and any tag can be queried directly via /v1/{window}/{tag}.
TweetFeed publishes the same data as CSV, JSON, RSS, MISP, STIX, TAXII and ready-made blocklists, so you can wire it into whichever SIEM, EDR, TIP or resolver you already run. Examples below default to year.csv (1-year window); swap to month.csv / week.csv / today.csv to keep the dataset smaller.
1. Match SHA256 hashes against the yearly feed
2. Match IP addresses against the monthly feed
3. Khả năng ứng dụng và giới hạn
3. Match URLs and domains against the weekly feed
The same KQL works in Microsoft Sentinel if you replace DeviceProcessEvents / DeviceNetworkEvents with the equivalent Sentinel tables (SecurityEvent, CommonSecurityLog, etc.).
Schedule a recurring CSV import via the Add-on Builder or the inputs.conf REST modular input, and refresh it on the same 15-minute cadence the feed publishes on (savedsearches.conf):
The CSV ships without a header row, so declare the field names in your lookup definition (transforms.conf -> fields_list = date, user, type, value, tags, tweet). The searches below assume those lowercase names.
Match firewall traffic against TweetFeed IPs:
For proxy / DNS logs vs. URLs and domains:
1. Pull the CSV into an index every 15 minutes with Logstash. document_id plus doc_as_upsert makes re-ingesting the same IOC idempotent, so overlapping windows never duplicate:
2. Join it against your telemetry with ES|QL, in Kibana Discover or Lens. DNS resolutions in the last 24h that hit a TweetFeed domain:
The resulting tweetfeed-iocs-* index doubles as a value list for Elastic Security detection rules, so the same data is alert-routable without a second pipeline.
Số liệu repository có thể thay đổi; nên mở liên kết nguồn để kiểm tra README, giấy phép và trạng thái phát hành.
Nguồn tham khảo: Xem bài gốc
