IntelMQ

IntelMQ is a solution for IT security teams (CERTs & CSIRTs, SOCs abuse departments, etc.) for collecting and processing security feeds (such as log files) using a message queuing protocol. It’s a community driven initiative called IHAP (Incident Handling Automation Project) which was conceptually designed by European CERTs/CSIRTs during several InfoSec events. Its main goal is to give to incident responders an easy way to collect & process threat intelligence thus improving the incident handling processes of CERTs.

General information

• Introduction
• IntelMQ Organizational Structure
• Getting support
• Development

User guide

• Hardware Requirements
• Installation
• Upgrade instructions
• Configuration and Management
• Bots inventory
• intelmqctl documentation
• Data Feeds
• IntelMQ API
• IntelMQ Manager
• Frequently asked questions

Connecting with other systems

• IntelMQ Universe
• ELK Stack
• MISP integrations in IntelMQ
• IntelMQ - n6 Integration
• CIFv3 integrations in IntelMQ
• EventDB
• Abuse-contact look-ups

Getting involved

• Developers Guide
• Running IntelMQ as Library
• Data Format
• Harmonization field names
• Release procedure
• Feeds wishlist
• Code documentation

Licence

This software is licensed under GNU Affero General Public License version 3

Funded by

This project was partially funded by the CEF framework

Indices and tables

• Index

• Module Index

• Search Page