Threat Triage CLI

Threat Triage CLI is a CLI reconnaissance tool for threat triage. It takes inbound noise such as automated scans, bots, misconfigured devices and enriches them using various threat intelligence API's like Virus Total, Shodan, etc...

Tech stack

• Go
• Cobra CLI framework
• go-fuzzyfinder for interactive selection in the terminal
• Various threat intelligence APIs for data enrichment (e.g., Virus Total, Shodan)

Usage

<APP> <COMMAND> <ARGUMENT>

Commands

• blacklist [COUNT] Shows a list of IP addresses using the go-fuzzyfinder library to allow the user to select an IP from the list
• ipreport <IP_ADDRESS> Show a report for a specific IP address
• filereport <FILE_HASH> Show a report for a specific file hash

Set environment variables

VT_API_KEY=<API_KEY>
SHODAN_API_KEY=<API_KEY>

Example

mazey.mp4