Dear community,
It's been a while since we've posted an update, but we've got a pretty big one in the pipeline. Right now, our setup is limited to three distinct feeds which don't leave much room for granular choice:
- Malware IP list
- Malware DNS list
- Phishing URL list (on request / requires proxy capabilities)
(Don't worry, these aren't going anywhere!)
The Custom Feed Hurdle: Initially, we wanted to build a custom feed generator allowing users to filter by threat scores, MITRE mappings, etc. However to be completely honest, it takes a massive toll on our infrastructure if 4,000+ users/companies are constantly compiling and pulling entirely unique feeds. We aren't quite there yet. It is still on our to do list though.
Our Plan B (Pre-Defined Feeds): Instead, we are rolling out a wider variety of curated, pre-defined feeds. Given that we pull from a 15M+ IOC database (You can browser it in our TIP / IOC browser), what distinguished feeds would actually add value to your OPNSense firewalls?
Some ideas we're tossing around:
- Risk tier splits (e.g., separating by High, Medium, and Low risk thresholds)
- Specific MITRE ATT&CK techniques or vectors
- Threat actor focused feeds
Drop your ideas or use cases below.
Those you mentioned above + those we actually already mentioned when Q-feeds first appeared on OPN as solution ;)
- Specific Feeds for VPN providers
This is so we can include and exclude because your system my flag an IP that was abused by an malicious user, but it doesn't mean the IP is malicious itself.
- I would honestly like as well Feeds based on ASN, at least as mappings.
Feeds aggregated by ASN/Companies. This would give the user possibility to block and target specific malicious ranges from specific ASNs
- Geo based Feeds
Feeds aggregated by countries.
I have to remember what else I was suggesting last year.
Regards,
S.