🚀 Advanced Threat Intelligence Platform & Dynamic Policy Enforcer

🚀 Advanced Threat Intelligence Platform & Dynamic Policy Enforcer

This project was developed as part of a Cyber Security Internship to demonstrate real-world Threat Intelligence, SIEM Integration, Security Monitoring, and Automated Incident Response.

The platform collects Indicators of Compromise (IOCs) from threat intelligence sources, normalizes and stores them in MongoDB, forwards them to Elasticsearch, visualizes threats in Kibana dashboards, and automatically blocks malicious IP addresses using Linux iptables firewall rules.

🔹 Features
• Threat Intelligence Collection
• IOC Normalization & Risk Scoring
• MongoDB Data Storage
• Elasticsearch SIEM Integration
• Kibana Threat Analytics Dashboard
• Dynamic Firewall Enforcement
• Firewall Rollback Mechanism
• Security Event Logging
• Continuous Monitoring

🔹 Technologies Used
• Python
• MongoDB
• Elasticsearch
• Kibana
• Linux
• iptables
• Git & GitHub

🔹 GitHub Repository
https://github.com/tryhackmeacct-netizen/Advanced-Threat-Intelligence-Platform-Dynamic-Policy-Enforcer

🔹 Quick Demo Commands

# Activate Project
source .venv/bin/activate

# Process IOC
python3 main.py --mode demo --indicators 198.1.1.1

# Verify MongoDB
mongosh
use threat_intelligence
db.ioc_data.find().sort({_id:-1}).limit(5).pretty()

# Verify Elasticsearch
curl -k -u elastic:'YOUR_ELASTIC_PASSWORD' https://localhost:9200

# Dynamic Firewall Enforcement
sudo .venv/bin/python main.py --mode demo --indicators 198.12.1.2

# Verify Firewall Rule
sudo iptables -L -n -v --line-numbers

# Firewall Rollback
sudo .venv/bin/python main.py --rollback 198.12.1.2

# Verify Rollback
sudo iptables -L -n -v --line-numbers

#CyberSecurity #ThreatIntelligence #SIEM #Elasticsearch #Kibana #MongoDB #Python #Linux #DevSecOps #SOC #BlueTeam #CyberSecurityProject