# Threat Intelligence Sources

## Open Source Intelligence (OSINT)

### Frameworks and Knowledge Bases
| Source | URL | Description |
|--------|-----|-------------|
| MITRE ATT&CK | attack.mitre.org | Adversary TTP knowledge base |
| MITRE CAPEC | capec.mitre.org | Attack pattern enumeration |
| CVE/NVD | nvd.nist.gov | Vulnerability database |

### Malware Repositories
| Source | URL | Access |
|--------|-----|--------|
| MalwareBazaar | bazaar.abuse.ch | Free |
| VirusTotal | virustotal.com | Free (limited) / Premium |
| Malshare | malshare.com | Free API key |
| vx-underground | vx-underground.org | Free |

### Threat Feeds
| Source | URL | Type |
|--------|-----|------|
| URLhaus | urlhaus.abuse.ch | Malware distribution URLs |
| Feodo Tracker | feodotracker.abuse.ch | Botnet C2 tracking |
| SSL Blacklist | sslbl.abuse.ch | Malicious SSL certificates |
| AlienVault OTX | otx.alienvault.com | Community threat pulses |
| Emerging Threats | rules.emergingthreats.net | Snort/Suricata rules |

### Reporting and Research
| Source | Type |
|--------|------|
| Vendor threat reports (CrowdStrike, Mandiant, ESET, Kaspersky, etc.) | APT tracking |
| US-CERT/CISA advisories | Government alerts |
| FIRST (first.org) | Incident response community |
| SANS Internet Storm Center | Daily threat diary |
| The DFIR Report | Detailed intrusion analysis |

## Commercial Platforms

| Platform | Specialty |
|----------|----------|
| CrowdStrike Falcon X | Adversary intelligence, automated analysis |
| Recorded Future | Predictive intelligence, dark web monitoring |
| Mandiant Advantage | Incident-based intelligence |
| ThreatConnect | Intelligence management platform |
| IBM X-Force Exchange | Threat research sharing |
| Palo Alto Unit 42 | Threat research and indicators |

## Information Sharing Communities

- **ISACs** (Information Sharing and Analysis Centers): Sector-specific
- **MISP instances**: Community-operated sharing platforms
- **STIX/TAXII feeds**: Automated indicator sharing
- **TLP (Traffic Light Protocol)**: Classification for sharing scope