Skip to content
This repository has been archived by the owner on Sep 10, 2021. It is now read-only.

ThreatConnect playbook to read a Google Alerts RSS feed and create indicators from the links.

License

Notifications You must be signed in to change notification settings

fhightower-tc/google-alerts-rss-reader-playbook

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Google Alerts RSS Reader Playbook

ThreatConnect playbook to read a Google Alerts RSS feed and create indicators from the links.

Google Alerts RSS Reader

Background

Once in a while, there is a Google search that turns up a lot of malicious or compromised domains. When this happens, it is helpful to use Google Alerts to get email alerts about the progress of the infection. One of the lesser-known features of Google Alerts, however, is that you can create an RSS feed of the alerts instead of getting email notifications (there are details and instructions on this here: https://thenextweb.com/google/2013/09/11/google-alerts-regains-rss-delivery-option-it-lost-after-google-readers-demise/).

Purpose

This playbook is designed to pull the content from an RSS feed of Google alerts, find the URLs from the alerts, and create those URLs as indicators in ThreatConnect.

About

ThreatConnect playbook to read a Google Alerts RSS feed and create indicators from the links.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published