🛡️ CTI Automation Platform

Automated Cyber Threat Intelligence Pipeline with Live Threat Dashboard
AlienVault OTX · AbuseIPDB · URLhaus · Splunk Correlator

---

📌 Overview

A fully automated Cyber Threat Intelligence (CTI) pipeline that:

1. Collects IOCs (Indicators of Compromise) from 3 live threat intelligence feeds
2. Correlates them against Splunk security logs to detect active threats
3. Visualizes everything on a real-time dark-themed threat dashboard

Built to demonstrate SOC Tier 2 and CTI Analyst level skills for enterprise blue team environments.

---

🎯 Features

Feature	Description
🔗 Multi-Feed Collection	Pulls IOCs from OTX, AbuseIPDB, URLhaus simultaneously
🔍 Splunk Correlation	Matches IOCs against real Splunk log events via REST API
📊 Live Dashboard	Real-time threat feed with severity classification
🌐 Threat Origin Map	Visualizes attacker geographic distribution
⚡ Auto Severity	Classifies alerts as CRITICAL / HIGH / MEDIUM / LOW
🔄 Demo Mode	Works fully offline without API keys

---

🏗️ Architecture

┌─────────────────────────────────────────────────────┐
│              CTI AUTOMATION PLATFORM                 │
├──────────────┬──────────────┬───────────────────────┤
│ AlienVault   │  AbuseIPDB   │       URLhaus          │
│    OTX       │  Blacklist   │   Malicious URLs       │
└──────┬───────┴──────┬───────┴──────────┬────────────┘
       │              │                  │
       └──────────────▼──────────────────┘
                 feeds/collector.py
                 (IOC Aggregator + Deduplication)
                        │
                        ▼
              data/iocs.json  ◄──── Stored IOCs
                        │
                        ▼
          correlator/splunk_correlator.py
          (Splunk REST API / Offline Correlation)
                        │
                        ▼
           data/correlation_hits.json
                        │
                        ▼
            dashboard/index.html
         (Live Threat Intelligence Dashboard)

---

📁 Project Structure

cti-platform/
├── feeds/
│   └── collector.py          # IOC collection from 3 threat feeds
├── correlator/
│   └── splunk_correlator.py  # Splunk REST API correlation engine
├── dashboard/
│   └── index.html            # Live dark-themed threat dashboard
├── data/
│   ├── iocs.json             # Collected IOCs (auto-generated)
│   ├── correlation_hits.json # Alert matches (auto-generated)
│   └── sample/
│       └── sample_logs.json  # Sample log events for demo
├── main.py                   # Main orchestrator
├── requirements.txt          # Python dependencies
└── README.md

---

⚙️ Setup & Installation

Prerequisites

• Python 3.10+
• Splunk Enterprise (optional — demo mode works without it)

1. Clone the repository

git clone https://github.com/ibu-cyx0/cti-automation-platform
cd cti-automation-platform

2. Install dependencies

pip install -r requirements.txt

3. Configure API keys (optional for live mode)

export OTX_API_KEY="your_otx_key_here"
export ABUSEIPDB_API_KEY="your_abuseipdb_key_here"
# URLhaus requires no API key

4. Run

# Demo mode (no API keys needed)
python main.py

# Live mode (with API keys + Splunk)
export SPLUNK_HOST="localhost"
export SPLUNK_USER="admin"
export SPLUNK_PASS="yourpassword"
python main.py

5. Open the Dashboard

Open dashboard/index.html in your browser

---

🔐 Threat Feeds Used

Feed	Type	Data	API Required
AlienVault OTX	Community	IPs, Domains, Hashes, URLs	✅ Free
AbuseIPDB	Crowd-sourced	Malicious IPs with confidence score	✅ Free
URLhaus	Malware	Active malware delivery URLs	❌ No key

---

🔍 Sample SPL Queries Used

# Detect IOC match in firewall logs
index=firewall (src_ip="185.220.101.47" OR dest_ip="185.220.101.47")
| table _time, src_ip, dest_ip, action, host

# Correlate all blocked IPs against IOC list
index=* action=blocked
| lookup ioc_lookup ip AS src_ip OUTPUT threat_name, severity
| where isnotnull(threat_name)
| stats count BY src_ip, threat_name, severity

# Detect outbound connections to known C2 domains
index=proxy_logs
| rex field=url "(?P<domain>[^/]+)"
| lookup ioc_lookup domain AS domain OUTPUT threat_name
| where isnotnull(threat_name)
| table _time, src_ip, url, threat_name

---

📊 Dashboard Features

• Live IOC Feed Table — streams new threats every second
• Severity Donut Chart — CRITICAL / HIGH / MEDIUM / LOW breakdown
• Source Bar Chart — IOC count by threat feed
• Threat Origin Map — geographic attacker distribution
• System Log Terminal — real-time event logging
• Auto-refresh — repeats every 30 seconds

---

🛠️ Tech Stack

• Python — feed collection, correlation logic
• Splunk REST API — log correlation (/services/search/jobs/export)
• AlienVault OTX API — threat pulse + IOC collection
• AbuseIPDB API — malicious IP blacklist
• URLhaus API — active malware URL feed
• HTML/CSS/JS — live threat intelligence dashboard
• Docker (optional) — containerized deployment

---

🗺️ Roadmap

• MISP integration for threat sharing
• Automated email alerting (SMTP)
• Elasticsearch support
• STIX/TAXII feed support
• ML-based IOC prioritization

---

👤 Author

Mohamed Ibrahim H
EC-Council Certified SOC Analyst (CSA) | Splunk Core Certified User | Cisco Cyber Ops Associate

• GitHub: @ibu-cyx0
• TryHackMe: @IbrahimCyb3r4
• Email: ibrahim.cybrx@gmail.com

---

📄 License

MIT License — free to use, modify, and distribute.