thryx

A lightweight web tool for enriching Indicators of Compromise (IOCs) such as IPs, domains, URLs, and hashes using multiple threat intelligence providers.

Features

• Web-based Interface: Simple, clean web UI for querying IOCs
• Multiple Providers: Integrates with various threat intelligence sources for comprehensive enrichment
• Caching: Uses Redis for response caching to improve performance
• Docker Support: Easy deployment with Docker Compose
• Extensible: Modular provider system for adding new intelligence sources

Supported IOC Types

• IPv4 addresses
• IPv6 addresses
• Domains
• URLs (automatically converted to domains)
• MD5 hashes
• SHA1 hashes
• SHA256 hashes

Providers

thryx integrates with the following threat intelligence providers:

• AbuseIPDB: IP reputation and abuse reports
• AlienVault OTX: Open Threat Exchange data
• CIRCL Hash Lookup: Hash-based malware lookup
• Shodan: Internet-connected device information
• ThreatFox: Malware IOC database from abuse.ch
• VirusTotal: Comprehensive file, URL, and IP analysis
• WHOIS: Domain registration information

Installation

Prerequisites

• Docker and Docker Compose
• API keys for the providers you want to use (optional but recommended)

Quick Start with Docker

1. Clone the repository:

   git clone https://github.com/yourusername/thryx.git
   cd thryx
   

2. Create a .env file with your API keys:

   ABUSEIPDB_API_KEY=your_abuseipdb_key
   SHODAN_API_KEY=your_shodan_key
   ALIENVAULT_API_KEY=your_alienvault_key
   VIRUSTOTAL_API_KEY=your_virustotal_key
   

3. Start the application:

   docker-compose up --build
   

4. Open your browser to http://localhost:8000

Manual Installation

1. Clone the repository and navigate to the directory

2. Install Python dependencies:

   pip install -r requirements.txt
   

3. Set up Redis (for caching):

   # Using Docker
   docker run -d -p 6379:6379 redis:alpine
   

4. Set environment variables for API keys

5. Run the application:

   flask --app app/app run --debug
   

Configuration

Configure the application using environment variables:

• REDIS_HOST: Redis host (default: localhost)
• REDIS_PORT: Redis port (default: 6379)
• ABUSEIPDB_API_KEY: AbuseIPDB API key
• SHODAN_API_KEY: Shodan API key
• ALIENVAULT_API_KEY: AlienVault OTX API key
• VIRUSTOTAL_API_KEY: VirusTotal API key

API keys are optional - providers without keys will be skipped during enrichment.

Usage

1. Open the web interface in your browser
2. Enter an IOC (IP, domain, hash, etc.) in the search box
3. Click "Search" or press Enter
4. View enriched results from all available providers
5. Click on provider links to view detailed information on their websites

Development

Project Structure

thryx/
├── app/
│   ├── api/           # API endpoints
│   ├── modules/       # Core functionality
│   ├── providers/     # Intelligence provider integrations
│   ├── static/        # CSS, icons
│   ├── templates/     # HTML templates
│   └── Dockerfile
├── docker-compose.yml
├── requirements.txt
└── README.md

Adding New Providers

1. Create a new file in app/providers/
2. Implement a class with:
   • name: Provider name
   • supported_query_types: List of supported IOC types
   • base_url: API base URL
   • api_key_env_var: API key environment variable
   • search(query): Method to query the provider

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the Apache License 2.0. - see the LICENSE file for details.

Disclaimer

This tool is for educational and research purposes. Users are responsible for complying with the terms of service of all integrated providers and applicable laws when using this tool.