IntelOwl Plugin
Since the recent release of IntelOwl 4.2.2, a CrowdSec analyzer has been included. Now IntelOwl users can leverage our CTI API to enrich their IP type observables. A big thanks to Matteo Lodi for writing this analyzer. IntelOwl is an Open Source Intelligence (OSINT) solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale. It integrates several analyzers available online and a lot of cutting-edge malware analysis tools. It is for everyone who needs a single point to query for info about a specific file or observable.
Prerequisites
- IntelOwl v4.2.2+
- CrowdSec CTI API Key.
Installation
CrowdSec's Analyzer is available and you should see it in the /plugins/analyzers section
To configure that plugin and add your API Key you must click on the "Your plugin config" button on the top right corner of that page and then go in the "secrets" section.
There, click on "add a new entry" and fill it like so :
- Type: Analyzer
- Plugin Name: CrowdSec
- Attribute: api_key_name
- Value: your API key
Usage
In the scan section, you can scan an IP type observable:
- Add the IP address as value.
- Select CrowdSec as one of the analyzers.
- Click Start Scan.
This will start a job that retrieves any information we have about this IP's malicious activities.
