Cyberbro : Revolutionizing Threat Intelligence With Simplified IoC Analysis

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services.
Inspired by Cybergordon and IntelOwl.

This project aims to provide a simple and efficient way to check the reputation of your observables using multiple services, without having to deploy a complex solution.

Features

• Effortless Input Handling: Paste raw logs, IoCs, or fanged IoCs, and let our regex parser do the rest.
• Multi-Service Reputation Checks: Verify observables (IP, hash, domain, URL) across multiple services like VirusTotal, AbuseIPDB, IPInfo, Spur.us, MDE, Google Safe Browsing, Shodan, Abusix, Phishtank, ThreatFox, URLscan, Github, Google…
• Detailed Reports: Generate comprehensive reports with advanced search and filter options.
• High Performance: Leverage multithreading for faster processing.
• Automated Observable Pivoting: Automatically pivot on domains, URL and IP addresses using reverse DNS and RDAP.
• Accurate Domain Info: Retrieve precise domain information from ICANN RDAP (next generation whois).
• Abuse Contact Lookup: Accurately find abuse contacts for IPs, URLs, and domains.
• Export Options: Export results to CSV and autofiltered well formatted Excel files.
• MDE Integration: Check if observables are flagged on your Microsoft Defender for Endpoint (MDE) tenant.
• Proxy Support: Use a proxy if required.
• Data Storage: Store results in a SQLite database.
• Analysis History: Maintain a history of analyses with easy retrieval and search functionality.

What Cyberbro Does That Others Don’t

• Accessible to everyone from beginners to experts. No gatekeeping here.
• Lightweight & Easy Deployment: Simple to set up and use.
• Advanced TLD Verification: Uses tldextract to accurately extract root domains, helping RDAP lookups.
• Pragmatic Information Gathering: Utilizes GitHub and Google indexed results to catch what other engines might miss.
• CTI Report Integration: Leverages IoC.One for IoC-related CTI reports in HTML or PDF.
• EDR Integration: Integrates with solutions like Microsoft Defender for Endpoint to check if observables were seen in YOUR environment.

Getting Started

• To get started, clone the repository

git clone https://github.com/stanfrbd/cyberbro
cd cyberbro

For more information click here.