Where do I start with Feeds

Overview

These integrations assume you have the python SDK and successfully installed and a valid ~/.cif.yml config. Installing the python client is as easy as:

$ pip cifsdk>=3.0.0a10

Starter Feeds

If you're not familiar with the [output] Feeds concept with CIF, checkout the CIF book. The most common feed combinations are:

IPV4

$ cif --feed --itype ipv4 --confidence 8 --tags scanner [--format snort|bro|csv|table|stix|json]
$ cif --feed --itype ipv4 --confidence 8 --tags hijacked 
$ cif --feed --itype ipv4 --confidence 8 --tags botnet
$ cif --feed --itype ipv4 --confidence 8 --tags malware
$ cif --feed --itype ipv4 --confidence 8 --tags spam 

FQDN

$ cif --feed --itype fqdn --confidence 8 --tags botnet [--format snort|bro|bind|...]
$ cif --feed --itype fqdn --confidence 8 --tags malware
$ cif --feed --itype fqdn --confidence 8 --tags phishing

$ cif --feed --itype fqdn --confidence 65 --tags malware

URL

$ cif --feed --itype url --confidence 8 --tags phishing [--format snort|bro|csv|table|stix|json]
$ cif --feed --itype url --confidence 8 --tags malware
$ cif --feed --itype url --confidence 8 --tags botnet