Dshield
Supported by community
Infrastructure & Attack Surface Visibility
Overview
DShield connector imports the SANS Internet Storm Center's Recommended Block List of top attacking IP subnets into OpenCTI as STIX indicators.
DShield is maintained by the Internet Storm Center (ISC) at SANS Institute and aggregates firewall logs from distributed sensors worldwide to identify the most aggressive attacking IP subnets.
This connector imports the DShield Recommended Block List into OpenCTI, converting the top attacking Class C (/24) subnets observed over the past three days into STIX 2.1 Indicators.
Key features:
- Curated block list of top attacking /24 subnets
- Community-sourced intelligence from thousands of distributed intrusion detection systems
- Automatic STIX 2.1 conversion
- Configurable TLP markings