Threat Intelligence

Tamandua EDR integrates with multiple threat intelligence sources to provide real-time detection of known malicious indicators. The threat intelligence system supports IOC feeds, STIX/TAXII protocols, and custom indicator management.

Vulnerability intelligence is tracked separately from generic IOC feeds. See

Vulnerability Intelligence Sources

for the conservative source baseline across NVD, EPSS, KEV, OSV.dev, GHSA,

vendor advisories, distro feeds, exploit references, malicious package

intelligence, and mobile package metadata.

Architecture Overview

+------------------+     +------------------+     +------------------+
|   External Feeds |     |   STIX/TAXII     |     |   Custom IOCs    |
|   - OTX          |     |   Servers        |     |   - API Upload   |
|   - AbuseIPDB    |     |                  |     |   - CSV Import   |
|   - URLhaus      |     |                  |     |   - Manual Entry |
+--------+---------+     +--------+---------+     +--------+---------+
         |                        |                        |
         v                        v                        v
+-----------------------------------------------------------------------+
|                        Threat Intel Aggregator                         |
|   - Normalization    - Deduplication    - Enrichment    - Scoring     |
+-----------------------------------------------------------------------+
         |                        |                        |
         v                        v                        v
+------------------+     +------------------+     +------------------+
|   ETS Cache      |     |   PostgreSQL     |     |   Agent Push     |
|   (Fast Lookup)  |     |   (Persistence)  |     |   (Sync)         |
+------------------+     +------------------+     +------------------+

Supported IOC Types

cve indicators are identifiers for correlation and enrichment. They do not by

themselves prove that an endpoint has an affected package, vulnerable build, or

reachable code path.

Pre-configured Feeds

Tamandua supports integration with popular threat intelligence feeds:

Configuring Feeds

# config/threat_intel.yaml
feeds:
  otx:
    enabled: true
    api_key: ${OTX_API_KEY}
    refresh_interval: 6h
    pulse_days: 30

  abuseipdb:
    enabled: true
    api_key: ${ABUSEIPDB_API_KEY}
    refresh_interval: 6h
    confidence_minimum: 90

  urlhaus:
    enabled: true
    refresh_interval: 1h
    status_filter: online

  malwarebazaar:
    enabled: true
    refresh_interval: 1h
    sample_type: exe

Environment Variables

# Required API keys
export OTX_API_KEY="your_otx_api_key"
export ABUSEIPDB_API_KEY="your_abuseipdb_key"

STIX/TAXII Integration

Tamandua supports STIX 2.1 and TAXII 2.1 for enterprise threat intelligence sharing.

Configuring TAXII Server

# config/taxii.yaml
taxii:
  servers:
    - name: "corporate_taxii"
      url: "https://taxii.company.com/taxii2/"
      username: ${TAXII_USER}
      password: ${TAXII_PASS}
      collections:
        - "indicators"
        - "malware"
      poll_interval: 1h

    - name: "isac_feed"
      url: "https://isac.example.org/taxii2/"
      api_key: ${ISAC_API_KEY}
      collections:
        - "all"
      poll_interval: 4h

Supported STIX Objects

STIX Pattern Support

# Example STIX patterns
[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']
[domain-name:value = 'evil.com']
[ipv4-addr:value = '192.168.1.1']
[url:value = 'http://malware.com/payload.exe']

Custom IOC Management

Adding IOCs via API

# Add single IOC
curl -X POST "https://api.tamandua.io/v1/iocs" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "ip",
    "value": "192.168.1.100",
    "severity": "high",
    "description": "Known C2 server",
    "tags": ["c2", "apt"],
    "source": "internal_investigation",
    "expires_at": "2025-12-31T23:59:59Z"
  }'

Bulk Import

# Import from CSV
curl -X POST "https://api.tamandua.io/v1/iocs/import" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file=@indicators.csv" \
  -F "format=csv"

# Import from STIX
curl -X POST "https://api.tamandua.io/v1/iocs/import" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file=@indicators.json" \
  -F "format=stix"

CSV Format

type,value,severity,description,tags,expires_at
ip,192.168.1.100,high,Known C2 server,"c2,apt",2025-12-31
domain,evil.com,critical,Malware distribution,"malware,phishing",
hash_sha256,abc123...,high,Ransomware sample,"ransomware,lockbit",

CLI Management

# Add IOC
tamanduactl ioc add --type ip --value 192.168.1.100 \
  --severity high --description "C2 server"

# List IOCs
tamanduactl ioc list --type ip --severity high

# Search IOCs
tamanduactl ioc search --query "192.168"

# Delete IOC
tamanduactl ioc delete --id ioc_123

# Export IOCs
tamanduactl ioc export --format csv --output iocs.csv

Hash Reputation

Tamandua provides hash reputation lookups for file analysis.

Lookup API

# Single hash lookup
curl "https://api.tamandua.io/v1/reputation/hash/sha256:abc123..." \
  -H "Authorization: Bearer $TOKEN"

Response:

{
  "hash": "abc123...",
  "reputation": "malicious",
  "confidence": 95,
  "sources": [
    {"name": "malwarebazaar", "verdict": "malicious", "family": "emotet"},
    {"name": "virustotal", "positives": 45, "total": 70}
  ],
  "first_seen": "2024-06-15T00:00:00Z",
  "last_seen": "2025-01-10T00:00:00Z",
  "tags": ["emotet", "trojan", "loader"],
  "mitre_techniques": ["T1566.001", "T1059.001"]
}

Batch Lookup

curl -X POST "https://api.tamandua.io/v1/reputation/hash/batch" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "hashes": [
      "sha256:abc123...",
      "sha256:def456...",
      "md5:xyz789..."
    ]
  }'

Reputation Levels

IOC Matching

Real-time Matching

IOCs are matched in real-time against:

Match Configuration

# Agent IOC matching config
ioc_matching:
  enabled: true

  # Cache size on agent
  cache_size: 50000

  # Sync interval
  sync_interval: 5m

  # Match types
  match_types:
    - ip
    - domain
    - hash_sha256
    - hash_md5
    - url

  # Actions on match
  actions:
    critical:
      - alert
      - quarantine
      - block
    high:
      - alert
      - quarantine
    medium:
      - alert
    low:
      - log

Match Alert

When an IOC matches, an alert is generated:

{
  "type": "ioc_match",
  "severity": "high",
  "ioc": {
    "type": "ip",
    "value": "192.168.1.100",
    "source": "abuseipdb",
    "description": "Known C2 server"
  },
  "context": {
    "process": "malware.exe",
    "pid": 1234,
    "connection": {
      "destination_ip": "192.168.1.100",
      "destination_port": 443
    }
  },
  "agent_id": "agent_123",
  "timestamp": "2025-01-15T10:30:00Z"
}

Feed Statistics

Get Feed Status

curl "https://api.tamandua.io/v1/threat-intel/feeds" \
  -H "Authorization: Bearer $TOKEN"

Response:

{
  "feeds": [
    {
      "name": "otx",
      "enabled": true,
      "status": "ok",
      "last_update": "2025-01-15T06:00:00Z",
      "ioc_count": 125000,
      "next_update": "2025-01-15T12:00:00Z"
    },
    {
      "name": "abuseipdb",
      "enabled": true,
      "status": "ok",
      "last_update": "2025-01-15T06:00:00Z",
      "ioc_count": 50000
    }
  ]
}

Get IOC Statistics

curl "https://api.tamandua.io/v1/threat-intel/stats" \
  -H "Authorization: Bearer $TOKEN"

Response:

{
  "total_iocs": 500000,
  "by_type": {
    "ip": 150000,
    "domain": 100000,
    "hash_sha256": 200000,
    "url": 50000
  },
  "by_source": {
    "otx": 125000,
    "abuseipdb": 50000,
    "urlhaus": 75000,
    "manual": 1000
  },
  "by_severity": {
    "critical": 10000,
    "high": 100000,
    "medium": 300000,
    "low": 90000
  },
  "last_update": "2025-01-15T10:00:00Z",
  "feeds_active": 6
}

IOC Enrichment

Tamandua automatically enriches IOCs with additional context:

Enrichment Sources

Enriched IOC Example

{
  "type": "ip",
  "value": "192.168.1.100",
  "reputation": "malicious",
  "enrichment": {
    "asn": {
      "number": 12345,
      "name": "Suspicious Hosting LLC",
      "country": "RU"
    },
    "geo": {
      "country": "Russia",
      "city": "Moscow",
      "lat": 55.7558,
      "lon": 37.6173
    },
    "whois": {
      "registrar": "NameCheap",
      "created": "2024-01-01",
      "expires": "2025-01-01"
    },
    "related_iocs": [
      {"type": "domain", "value": "evil.com"},
      {"type": "hash_sha256", "value": "abc123..."}
    ]
  }
}

Threat Intelligence API

Search IOCs

GET /api/v1/iocs?type=ip&severity=high&limit=100

# Response
{
  "iocs": [...],
  "total": 5000,
  "page": 1,
  "per_page": 100
}

Get IOC Details

GET /api/v1/iocs/{ioc_id}

# Response
{
  "id": "ioc_123",
  "type": "ip",
  "value": "192.168.1.100",
  "severity": "high",
  "description": "C2 server",
  "source": "abuseipdb",
  "tags": ["c2", "apt"],
  "created_at": "2025-01-01T00:00:00Z",
  "expires_at": "2025-12-31T23:59:59Z",
  "match_count": 15,
  "last_match": "2025-01-15T10:00:00Z"
}

Create IOC

POST /api/v1/iocs
Content-Type: application/json

{
  "type": "domain",
  "value": "evil.com",
  "severity": "critical",
  "description": "Malware distribution",
  "tags": ["malware", "phishing"],
  "expires_at": "2025-12-31T23:59:59Z"
}

Update IOC

PATCH /api/v1/iocs/{ioc_id}
Content-Type: application/json

{
  "severity": "critical",
  "tags": ["malware", "phishing", "apt"]
}

Delete IOC

DELETE /api/v1/iocs/{ioc_id}

Manual Feed Refresh

POST /api/v1/threat-intel/feeds/refresh

# Response
{
  "status": "refreshing",
  "feeds_queued": ["otx", "abuseipdb", "urlhaus"]
}

Best Practices

Feed Selection

1. Enable reputable feeds - OTX, AbuseIPDB have good quality
2. Avoid duplicate sources - Prevent IOC bloat
3. Configure confidence thresholds - Filter low-quality IOCs
4. Set expiration dates - Remove stale indicators

IOC Management

1. Regular cleanup - Remove expired IOCs
2. Deduplicate entries - Merge duplicates from multiple sources
3. Tag consistently - Use standard taxonomy (MITRE, kill chain)
4. Document sources - Track provenance for auditing

Performance

1. Limit cache size - Balance memory vs. coverage
2. Use hash-based IOCs - Faster than regex patterns
3. Prioritize by severity - Load critical IOCs first
4. Monitor match rates - Identify noisy indicators

Related Documentation

• Detection Overview - Multi-layered detection strategy
• Response Actions - Actions on IOC matches
• MITRE Coverage - ATT&CK mapping