ThreatDB

Evolutionary Threat Intelligence Database

Core Architecture

• SQLite + Elasticsearch + Zeek logs
• Automatic queries against Elastic Stack every 12 hours
• IP address collection for beacon detection

Enrichment

IP addresses checked against:

• ASN
• VirusTotal
• AbuseCH
• Custom Enrichment Markers

Analysis Questions

• Previous DNS resolutions for the IP?
• Traffic distribution (packets per hour)?
• Unusual packet sizes?
• Firewall status?
• Internal host diversity?

The Goal

Daily review of suspicious IPs to validate or block (e.g., via Firewall rules).

Roadmap

• AI-Supported Investigation (False Positive reduction)
• Case Management (Whitelist/TP/FP)
• Alerting (Pushover, Slack, Teams)