muninn

An Integrated Web-based Dashboard for Threat Analysis

Modules:

1. Web server – Apache 2.0

2. Searching and indexing service – Elasticsearch

3. Parsing and filtering service – Logstash

4. Data visualization platform – Kibana

5. System statistics collection – Metricbeat

6. Log data collection – Filebeat

7. Network statistics collection – Packetbeat

8. Active network connection monitoring– Custom agent

9. Threat intelligence aggregation – Minemeld

10. Alerting service – Elastalert

11. Threat analysis –

    a. VirusTotal API

    b. Shodan API

    c. Whois information – ipdata.co

12. Real-time malware campaign tracking – AlienVault OTX

13. Threat Attribution – MITRE ATT&CK Kibana Dashboard

Architecture

Threat Dashboard

Threat Attribution Dashboard

VirusTotal Intel

Pushing Telegram alert

Received Telegram alert