{"id":22180570,"url":"https://github.com/dcso/tie-threatbus-bridge","last_synced_at":"2025-07-26T17:32:18.541Z","repository":{"id":53595612,"uuid":"291052857","full_name":"DCSO/tie-threatbus-bridge","owner":"DCSO","description":"tool to feed IoCs from DCSO TIE to Threat Bus","archived":false,"fork":false,"pushed_at":"2023-09-22T12:10:30.000Z","size":22,"stargazers_count":5,"open_issues_count":1,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-06-19T23:14:48.621Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DCSO.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2020-08-28T13:24:37.000Z","updated_at":"2023-09-22T07:21:25.000Z","dependencies_parsed_at":"2023-09-22T21:54:16.851Z","dependency_job_id":null,"html_url":"https://github.com/DCSO/tie-threatbus-bridge","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ftie-threatbus-bridge","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ftie-threatbus-bridge/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ftie-threatbus-bridge/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ftie-threatbus-bridge/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DCSO","download_url":"https://codeload.github.com/DCSO/tie-threatbus-bridge/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227700405,"owners_count":17806365,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-02T09:18:44.588Z","updated_at":"2024-12-02T09:18:45.476Z","avatar_url":"https://github.com/DCSO.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TIE\u003c-\u003eThreatBus Bridge\n\nThis tool acts as a bridge between the TIE and\n[Threat Bus](https://github.com/tenzir/threatbus) software components.\nIt can be used to regularly query the TIE API and publishes new IOCs to\nThreatBus. This is necessary since TIE does not have a push hook to use\nfor that purpose.\n\n## Dependencies\n\nWe need libzmq for ZeroMQ communication to Threat Bus.\n\n```\n$ sudo apt install libzmq3-dev\n```\n\n## Building\n\n```\n$ go get github.com/DCSO/tie-threatbus-bridge\n```\n\n## Running\n```\n$ tie-threatbus-bridge -help\nUsage of ./tie-threatbus-bridge:\n  -config string\n    \tconfiguration file (default \"config.yaml\")\n  -verbose\n    \tbe verbose\n```\n\nExample:\n\n```\n$ tie-threatbus-bridge --config config.yaml\n```\n\n## Configuration\n\n```yaml\n# Collectors settings\n# -------------------\ncollectors:\n  tie:\n    # Set to true to enable this collector\n    enable: true\n    # TIE API version. Currently: 1\n    api-version: 1\n    # Base URL for the DCSO TIE service\n    baseurl: https://tie.dcso.de/api/v1/iocs\n    # TIE token for the API\n    token: \u003credacted\u003e\n    # Categories to select IoCs for\n    categories:\n      - c2-server\n      - espionage\n    # Indicator types to be selected from the TIE\n    data-types:\n      - DomainName\n      - URLVerbatim\n    # Time selection constraint\n    since: 4h\n    # Query name, e.g. \"updated_at_since\", \"created_at_since\", \"first_seen_since\"\n    time-query-name: created_at_since\n    # Severity range to search for. Both ends need to be specified\n    # (range 0-6)\n    severity:\n      from: 1\n      to: 5\n    chunk-size: 100\n    # Maximum limit for returned IoCs, which will be returned sorted by\n    # data types, in the order specified in the \"data-types\" config field above\n    # Set to 0 to disable limiting.\n    limit:\n      total: 1000\n\n# Threat Bus ZeroMQ connection settings\n# -------------------------------------\nthreatbus:\n  host: 1.0.0.1\n  port: 13372\n  # legacy or stix2\n  format: legacy\n\nlogfile: /var/log/tie-threatbus-bridge.log\n```\n\n## Operation\n\nTrigger an update by sending `SIGUSR1` to the process:\n\n```\n$ kill -USR1 `pgrep tie-threatbus`\n```\nThis is useful, for example, to trigger regular updates via a cron job.\n\n## Ideas for improvement\n\n - Deduplication of repeating IOCs\n\n## Contact\n\nSascha Steinbiss\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ftie-threatbus-bridge","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdcso%2Ftie-threatbus-bridge","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ftie-threatbus-bridge/lists"}