1 个仓库
Processes diverse external security feed formats into a standardized representation for consistent firewall application.
Distinct from Trace Format Normalization: Distinct from Trace Format Normalization: focuses on threat intelligence lists rather than telemetry spans.
Explore 1 awesome GitHub repository matching data & databases · Threat Intelligence Normalizations. Refine with filters or upvote what's useful.
This project is a security utility for aggregating threat intelligence and automating the deployment of high-performance firewall rules. It functions as an aggregator that fetches and normalizes malicious IP address lists from multiple external security feeds and a management tool that deploys these lists into the Linux kernel using ipset for packet filtering. The system maintains network perimeter defense by using atomic kernel updates to swap IP sets, which allows firewall rules to be updated without interrupting active connections. It includes a range optimizer that simplifies network addr
Normalizes diverse external threat intelligence formats into a standard representation for firewall application.