Blog
Anomali Limo – Take the Fast Lane to Threat Intelligence
Anissa Khalid
August 24, 2017
<p>Far from being just a buzzword, threat intelligence has proven to be a valuable asset to security teams. 78% of respondents polled from <a href="https://www.anomali.com/resources/whitepapers/value-of-threat-intelligence-ponemon-study">The Value of Threat Intelligence: Ponemon Study</a>, stated that threat intelligence was critical for a strong security posture. One of the difficulties with threat intelligence isn’t necessarily recognizing its value, though - it’s getting started.</p><p>At Anomali we wanted to provide people with an easy-to-use tool for collecting and analyzing threat data, which is why we built <a href="https://www.anomali.com/community/staxx">STAXX</a>. It’s a free TAXII client that allows you to subscribe to any STIX/TAXII feed and link to an online portal for investigations. In the past months we’ve made a lot of changes to ensure that STAXX has everything needed to start incorporating threat intelligence into their security systems. We've even upped our game by including our new <a href="https://www.anomali.com/community/limo">Limo</a> services to partner with our TAXII client.</p><p>Limo is a preconfigured set of intelligence feeds that STAXX users can access immediately upon download. It’s completely free, and provides information from our <a href="https://www.anomali.com/community/weekly-threat-briefing">Weekly Threat Briefing</a>, Anomali Labs data, and other open source intelligence feeds.<br/> <br/> Below is a list of the current Limo feeds and a description of what they provide. If there’s something you think we missed or would like to see, feel free to let us know in our <a href="https://forum.anomali.com/">Forum</a>. We’re always looking for <em>feed</em>back (even if it’s that you don’t like puns).</p><p><strong>Anomali_Weekly_Threat_Briefing</strong><br/> This feed provides threat indicators from our Weekly Threat Briefings. Each briefing contains curated intelligence about the latest active threats in the news and around the world. A brief analysis from our Anomali Labs team provides some technical insight as to why these threats are relevant. With threat actors consistently altering their malicious tacitcs, keeping up-to-date on the most recent threats and vulnerabilities is critical. You can also subscribe to this information and receive email updates, or check back to our blog on Tuesday's.</p><p><a class="button button-xlarge button-rounded button-blue-grad" href="https://www.anomali.com/community/weekly-threat-briefing">SUBSCRIBE</a> </p><p><strong>Blutmagie_TOR_Nodes</strong><br/> Blutmagie_TOR_Nodes contains a list of exit nodes provided by the website <a href="https://torstatus.blutmagie.de/" target="_blank">Tor Network Status</a>. Tor is used as a vector for cyber-attacks, and traffic to and from a Tor exit node could be an indication of an attack.</p><p><strong>Emerging_Threats___Compromised</strong><br/> Bots, phishing sites, and hostile traffic – oh my! This Limo feed provides hosts published by <a href="http://doc.emergingthreats.net/" target="_blank">Emerging Threats</a> that are known to be significantly infected or hostile.</p><p><strong>Lehigh_Malwaredomains</strong><br/> Lehigh_Malwaredomains specializes in providing domains that are known to be used to propagate malware and spyware, as published by the <a href="http://www.malwaredomains.com/" target="_blank">DNS-BH project</a>.</p><p><strong>Phish_Tank</strong><br/> This Limo feed provides phishing data from <a href="https://www.phishtank.com/" target="_blank">PhishTank</a>, a free community site. Phishing is one of the most common and successful kind of attacks. Check out our blog, <a href="https://www.anomali.com/blog/teach-a-man-to-phish">Teach a Man to Phish</a>, to learn how your adversaries might try to trick you.</p><p><strong>CyberCrime</strong><br/> <a href="http://cybercrime-tracker.net/" target="_blank">Cybercrime-tracker.net</a> provides Indicators of Compromise focused on banking malware such as Zeus, Pony, etc.</p><p><strong>DShield_Scanning_Ips_F150</strong><br/> DShield is a community-based collaborative firewall log correlation system. It receives logs from volunteers worldwide and uses them to analyze attack trends. This Limo feed provides threat indicators for IP addresses that have been observed performing mass scanning activities, provided by <a href="https://isc.sans.edu/" target="_blank">Internet Storm Center</a>.</p><p><strong>Abuse_ch_Ransomware_Domains</strong><br/> <a href="https://ransomwaretracker.abuse.ch/" target="_blank">Ransomware Tracker</a> provides domain names that are associated with Ransomware, such as Botnet command and control (C&C) servers, distribution sites, and payment sites. </p><p><strong>Abuse_ch_Ransomware_IPs</strong><br/> This feed is the same as above, but with IPs rather than domains. Remember with ransomware it doesn’t pay to pay – you’ll just get played.</p><p><strong>Malware_Domain_List___Hotlist</strong><br/> This is a community-based malware domain list project with infromation from <a href="https://www.malwaredomainlist.com/" target="_blank">Malware Domain List</a>. </p><p><strong>Emerging_Threats_C_C_Server</strong><br/> This is a feed of the <a href="http://doc.emergingthreats.net/" target="_blank">Emerging Threats’</a> command and control hosts.</p><p>We’ll be publishing a few how-to’s in future blogs to explain how you can take the information from these feeds and make it actionable. Subscribe to our blog to make sure you don’t miss out!</p>
Discover More About Anomali
Get the latest news about cybersecurity, threat intelligence, and Anomali's Security and IT Operations platform.
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
