Open source threat intelligence is [[Threat Intelligence]] *that is acquired from publicly available sources*. A number of sites maintain extensive lists of open source threat information sources: - `Senki.org` provides a list: www.senki.org/operators-securitytoolkit/open-source-threat-intelligence-feeds - The Open Threat Exchange operated by AT&T is part of a global community of security professionals and threat researchers: https://cybersecurity.att.com/open-threat-exchange - The MISP Threat Sharing project, www.misp-project.org/feeds, provides standardised threat feeds from many sources, with community-driven collections. - Threatfeeds.io hosts a list of open source threat intelligence feeds, with details of when they were added and modified, who maintains them, and other useful information: threatfeeds.io Vendor websites: - Microsoft's threat intelligence blog: www.microsoft.com/security/blog/tag/threat-intelligence - Cisco's threat security site (tools.cisco.com/security/center/home.x) includes an experts' blog with threat research information, as well as the Cisco Talos reputation lookup tool, `talosintelligence.com` Public sources: - The SANS Internet Storm Center: `isc.sans.org ` - VirusShare contains details about malware uploaded to VirusTotal: `virusshare.com` - Spamhaus focuses on block lists, including spam via the Spamhaus Block List (SBL), hijacked and compromised computers on the Exploits Block List (XBL), the Policy Block List (PBL), the Don't Route or Peer lists (DROP) listing netblocks that you may not want to allow traffic from, and a variety of other information: www.spamhaus.org ### Proprietary and Closed-Source Intelligence *Commercial security vendors, government organisations, and other security-centric organisations* also create and make use of proprietary, or closed-source intelligence. They do their own information gathering and research, and they may use custom tools, analysis models, or other proprietary methods to gather, curate, and maintain their threat feeds. There are a number of reasons that proprietary threat intelligence may be used. The organization *may want to keep their threat data secret*, they *may want to sell or license it* and their methods and sources are their trade secrets, or they *may not want to take the chance of the threat actors knowing* about the data they are gathering. > [!tip] Tip > You may want to have multiple feeds that you can check against each other—often one feed may be faster or release information sooner, so multiple good-quality, reliable feeds can be a big help!. [[Active Reconnaissance]]