Brand, Digital Risk & Underground Exposure
Aperçu
Import Flare threat intelligence events (leaked credentials, stealer logs, lookalike domains, ransomware leaks) as STIX2 incidents into OpenCTI.
This connector integrates Flare (https://flare.io) — a cyber threat intelligence platform monitoring dark web, leak sites, threat actor forums, and other external sources — with OpenCTI. It periodically fetches new security events from the Flare API and converts them into STIX2 incidents with related observables. Supported event types include leaked credentials (emails, usernames), stealer logs from infected devices (with associated malware family), lookalike/typosquatting domains, and ransomware leak publications. Each event is imported as a STIX Incident linked to its relevant observables (EmailAddress, UserAccount, IPv4Address, DomainName, URL) via related-to relationships.