threatfeed

Documentation

Index

• func Start(cfg *config.ThreatFeed)
• func Update(ip string, threatScore int)
• type IOC

Functions

func Start

func Start(cfg *config.ThreatFeed)

Start initializes and starts the threat feed server. The server provides a list of IP addresses observed interacting with the honeypot servers in various formats.

func Update

func Update(ip string, threatScore int)

Update updates the threat feed with the provided source IP address and threat score. This function should be called by honeypot servers whenever a client interacts with the honeypot. If the source IP address is already in the threat feed, its last-seen timestamp is updated, and its threat score is incremented. Otherwise, the IP address is added as a new entry in the threat feed.

Types

type IOC

type IOC struct {
	// contains filtered or unexported fields
}

IOC represents an Indicator of Compromise (IOC) entry that stores information about IP addresses that interact with the honeypot servers.