andrewsmhay / ioc2halo Goto Github PK

##ioc2halo

###About OpenIOC is an extensible XML schema that enables you to describe the technical characteristics that identify a known threat, an attacker’s methodology, or other evidence of compromise.

OpenIOC was originally designed to enable MANDIANT’s products to codify intelligence in order to rapidly search for potential security breaches. Now, in response to requests from across the user community, MANDIANT has standardized and open sourced the OpenIOC schema and is releasing tools and utilities to allow communication of threat information at machine speed.

The base OpenIOC schema is a simple framework that is written in XML to document and categorize forensic artifacts of an intrusion that can be identified on a host or network. This script converts IOC formatted files into the policy format supported by CloudPassage Halo.

###Usage

Soon...

###Contact

To provide any feedback or ask any questions please reach out to Andrew Hay on Twitter at @andrewsmhay.

###References CloudPassage, Inc. - http://www.cloudpassage.com/ OpenIOC Framework - http://www.openioc.org/ MANDIANT - http://www.mandiant.com/