threat-intel 0.1.0

Comprehensive threat intelligence framework with multi-source aggregation, CVE integration, and risk assessment
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
# Architecture

## System Overview

Threat Intel implements a **multi-source aggregation system** that fetches, parses, and correlates threat intelligence from diverse sources into a unified query interface.

```
┌─────────────────────────────────────────────────────────────┐
│                   ThreatIntelEngine                          │
│              (Aggregation & Query Interface)                 │
├─────────────────────────────────────────────────────────────┤
│  - initialize()                                              │
│  - sync()                                                    │
│  - query_vulnerabilities()                                   │
│  - query_iocs()                                              │
│  - query_threat_actors()                                     │
│  - assess_risk()                                             │
└───────────────────┬──────────────────────────────────────────┘
       ┌────────────┴────────────┬────────────┬────────────┐
       │                         │            │            │
       ▼                         ▼            ▼            ▼
┌──────────────┐        ┌──────────────┐  ┌───────┐  ┌───────┐
│   MITRE      │        │     CVE      │  │Abuse  │  │Custom │
│   ATT&CK     │        │   Database   │  │ .ch   │  │Source │
│              │        │   (NIST NVD) │  │       │  │       │
│ Priority: 10 │        │ Priority: 9  │  │ Pri:7 │  │ Pri:8 │
└──────┬───────┘        └──────┬───────┘  └───┬───┘  └───┬───┘
       │                       │              │          │
       │        ┌──────────────┴──────────────┴──────────┘
       │        │
       ▼        ▼
┌─────────────────────────────────────────────────────────────┐
│                     FeedFetcher                              │
│                 (HTTP Client + Auth)                         │
├─────────────────────────────────────────────────────────────┤
│  - Authenticated HTTP requests                               │
│  - Retry logic with exponential backoff                      │
│  - Multiple auth methods (API Key, Bearer, Basic)            │
│  - Timeout management                                        │
└─────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────┐
│                      ThreatCache                             │
│               (In-Memory Data Store)                         │
├─────────────────────────────────────────────────────────────┤
│  HashMap<SourceID, ThreatData>                               │
│    - Vulnerabilities                                         │
│    - IOCs (Indicators of Compromise)                         │
│    - Threat Actors                                           │
│    - Raw data (JSON)                                         │
└─────────────────────────────────────────────────────────────┘
```

## Core Components

### 1. ThreatIntelEngine

Central orchestrator for all threat intelligence operations.

**Responsibilities:**
- Source initialization and management
- Periodic synchronization
- Query aggregation across sources
- Risk assessment
- Statistics and monitoring

**State:**
```rust
pub struct ThreatIntelEngine {
    config: ThreatIntelConfig,
    sources: HashMap<String, Box<dyn ThreatSource>>,
    last_sync: Option<DateTime<Utc>>,
    cache: ThreatCache,
}
```

**Location:** `src/lib.rs`

### 2. ThreatSource Trait

Abstract interface for all threat intelligence sources.

**Interface:**
```rust
pub trait ThreatSource: Send + Sync {
    async fn fetch(&mut self) -> Result<ThreatData>;
    fn config(&self) -> &SourceConfig;
}
```

**Implementations:**
- `MitreAttackSource` - MITRE ATT&CK framework data
- `CVESource` - CVE/NVD vulnerability database
- `OSINTSource` - Open-source intelligence feeds
- `GenericSource` - Custom HTTP endpoints

**Location:** `src/sources/`

### 3. FeedFetcher

HTTP client with authentication and retry logic.

**Features:**
- Multiple auth methods (API Key, Bearer, Basic)
- Exponential backoff retry (3 attempts)
- Configurable timeouts (default 30s)
- TLS/SSL support
- Header customization

**Authentication Flow:**
```
Request
  │
  ├─ AuthType::None
  │    └─> Plain HTTP request
  │
  ├─ AuthType::ApiKey
  │    └─> Header: X-API-Key: {key}
  │
  ├─ AuthType::Bearer
  │    └─> Header: Authorization: Bearer {token}
  │
  └─ AuthType::Basic
       └─> Header: Authorization: Basic base64({user}:{pass})
```

**Location:** `src/feeds/`

### 4. ThreatCache

In-memory storage for aggregated threat intelligence.

**Structure:**
```rust
struct ThreatCache {
    cache: HashMap<String, ThreatData>,
}

pub struct ThreatData {
    pub vulnerabilities: Vec<Vulnerability>,
    pub iocs: Vec<IOC>,
    pub threat_actors: Vec<ThreatActor>,
    pub raw_data: Option<serde_json::Value>,
}
```

**Operations:**
- `update(source_id, data)` - Store source data
- `get(source_id)` - Retrieve source data
- Automatic conflict resolution by source priority

**Location:** `src/lib.rs`

## Data Models

### Vulnerability

```rust
pub struct Vulnerability {
    pub id: String,                          // Internal ID
    pub cve_id: Option<String>,              // CVE-2024-XXXX
    pub title: String,                       // Short description
    pub description: String,                 // Detailed description
    pub severity: Severity,                  // Critical/High/Medium/Low/Info
    pub cvss_score: Option<f32>,            // 0.0 - 10.0
    pub affected_products: Vec<AffectedProduct>,
    pub published_date: DateTime<Utc>,
    pub last_modified: DateTime<Utc>,
    pub references: Vec<String>,            // URLs
}
```

### IOC (Indicator of Compromise)

```rust
pub struct IOC {
    pub id: String,
    pub ioc_type: IOCType,                   // IP, Domain, Hash, etc.
    pub value: String,                       // The actual IOC
    pub description: Option<String>,
    pub confidence: f32,                     // 0.0 - 1.0
    pub first_seen: DateTime<Utc>,
    pub last_seen: DateTime<Utc>,
    pub tags: Vec<String>,
}
```

### Threat Actor

```rust
pub struct ThreatActor {
    pub id: String,
    pub name: String,                        // APT28, Lazarus Group, etc.
    pub aliases: Vec<String>,                // Alternative names
    pub description: String,
    pub tactics: Vec<String>,                // MITRE tactics
    pub techniques: Vec<String>,             // MITRE techniques
    pub first_seen: Option<DateTime<Utc>>,
    pub country: Option<String>,
    pub motivation: Option<String>,
}
```

## Query Flow

### Vulnerability Query

```
User Query: "apache", "2.4"
  │
  ▼
┌─────────────────────────────────────────────┐
│ 1. Get sources with Vulnerabilities capability│
└───────────────────┬─────────────────────────┘
┌─────────────────────────────────────────────┐
│ 2. For each source:                          │
│    - Fetch cached data                       │
│    - Filter vulnerabilities by:              │
│      * product name contains "apache"        │
│      * version matches "2.4"                 │
└───────────────────┬─────────────────────────┘
┌─────────────────────────────────────────────┐
│ 3. Aggregate results from all sources       │
└───────────────────┬─────────────────────────┘
┌─────────────────────────────────────────────┐
│ 4. De-duplicate by CVE ID                   │
│    (priority source wins conflicts)          │
└───────────────────┬─────────────────────────┘
Results: Vec<Vulnerability>
```

### IOC Query

```
User Query: IOCType::IpAddress
  │
  ▼
┌─────────────────────────────────────────────┐
│ 1. Get sources with IOC capability          │
└───────────────────┬─────────────────────────┘
┌─────────────────────────────────────────────┐
│ 2. For each source:                          │
│    - Fetch cached data                       │
│    - Filter IOCs by type                     │
└───────────────────┬─────────────────────────┘
┌─────────────────────────────────────────────┐
│ 3. Aggregate and de-duplicate                │
│    (by IOC value)                            │
└───────────────────┬─────────────────────────┘
Results: Vec<IOC>
```

## Sync Mechanism

### Initialization

```
engine.initialize()
  │
  ├─ For each enabled source in config:
  │   │
  │   ├─ Create source instance
  │   │   (MitreAttackSource, CVESource, etc.)
  │   │
  │   ├─ Store in sources HashMap
  │   │
  │   └─ Continue on error (resilient)
  │
  └─ Perform initial sync()
```

### Periodic Sync

```
engine.sync()
  │
  └─ For each source:
      ├─ Call source.fetch()
      │   │
      │   ├─ FeedFetcher makes HTTP request
      │   │   with authentication
      │   │
      │   ├─ Parse response (JSON)
      │   │
      │   ├─ Transform to ThreatData
      │   │
      │   └─ Return or retry on failure
      ├─ Update cache with new data
      │   cache.update(source_id, data)
      └─ Continue on error (other sources still update)
```

**Update Frequencies:**
- `Realtime`: On every query (not recommended)
- `Hourly`: Every hour
- `Daily`: Once per day
- `Weekly`: Once per week
- `Manual`: Only when explicitly synced

## Risk Assessment Engine

### Algorithm

```
Input: Vec<Vulnerability>
  │
  ├─ Count by severity:
  │   - critical_count
  │   - high_count
  │   - medium_count
  │   - low_count
  │
  ├─ Calculate score:
  │   score = (critical × 10) + (high × 7) + (medium × 4) + (low × 1)
  │
  ├─ Determine risk level:
  │   - Critical: if any critical vulnerabilities
  │   - High: if high >= 3
  │   - Medium: if high > 0 or medium >= 5
  │   - Low: if medium > 0 or low > 0
  │   - Info: otherwise
  │
  └─ Generate recommendations:
      - Based on risk level
      - Specific CVEs (top 3)
      - Prioritized actions

Output: RiskAssessment
```

### RiskAssessment Structure

```rust
pub struct RiskAssessment {
    pub level: RiskLevel,                // Critical/High/Medium/Low/Info
    pub score: f32,                      // Calculated risk score
    pub critical_count: usize,
    pub high_count: usize,
    pub medium_count: usize,
    pub low_count: usize,
    pub recommendations: Vec<String>,    // Actionable advice
}
```

## Source Capabilities

Sources declare their capabilities to enable targeted queries:

```rust
pub enum SourceCapability {
    Vulnerabilities,    // CVE, exploit info
    Ioc,               // IPs, domains, hashes
    ThreatActors,      // APT groups, actors
    Tactics,           // MITRE tactics
    Techniques,        // MITRE techniques
    Malware,           // Malware families
    Exploits,          // Exploit code
    Patches,           // Security patches
}
```

**Query Optimization:**
Only sources with relevant capabilities are queried for each request.

## Configuration Architecture

```rust
pub struct ThreatIntelConfig {
    pub sources: Vec<SourceConfig>,
    pub sync_interval_hours: u64,
    pub cache_enabled: bool,
    pub cache_ttl_hours: u64,
}

pub struct SourceConfig {
    pub id: String,                      // Unique identifier
    pub name: String,                    // Display name
    pub source_type: SourceType,         // MitreAttack, Cve, Osint, etc.
    pub enabled: bool,
    pub api_url: Option<String>,
    pub api_key: Option<String>,
    pub auth_type: AuthType,
    pub update_frequency: UpdateFrequency,
    pub priority: u8,                    // 1-10, higher wins conflicts
    pub capabilities: Vec<SourceCapability>,
    pub timeout_secs: u64,
    pub retry_count: u32,
}
```

## Error Handling

### Resilient Design

- Source failures don't stop initialization
- Sync errors are logged but other sources continue
- Queries aggregate from available sources
- Cache provides last-known-good data

### Error Types

```rust
pub enum ThreatIntelError {
    SourceInitFailed(String),
    FetchFailed(String),
    ParseError(String),
    NetworkError(String),
    AuthenticationFailed,
    RateLimitExceeded,
    InvalidConfiguration(String),
}
```

## Performance Characteristics

### Memory Usage
- Cache size: ~1-10MB per source (depends on data volume)
- No disk I/O (pure in-memory)
- Configurable TTL for cache eviction

### Network Usage
- Initial fetch: 100KB - 10MB per source
- Updates: Incremental when supported
- Configurable update frequency

### Query Performance
- Latency: < 1ms for cached queries
- Throughput: 10,000+ queries/sec
- Concurrent queries: Lock-free reads (RwLock)

## Security Considerations

### Data Integrity
- TLS/SSL for all HTTP connections
- Signature verification (future feature)
- Source priority for conflict resolution

### Authentication
- API keys stored in memory only
- Support for environment variables
- No plaintext key logging

### Rate Limiting
- Respectful of source rate limits
- Exponential backoff on errors
- Configurable retry strategies

## Future Enhancements

### v0.2
- Database backend (PostgreSQL, SQLite)
- XML and STIX format parsers
- Webhook notifications

### v0.3
- ML-based threat correlation
- GraphQL query API
- Distributed caching (Redis)

### v0.4
- Threat feed validation
- TAXII protocol support
- Advanced analytics