🛡️ Real-Time Cyber Threat Intelligence Platform (still under-dev)

A real-time threat intelligence ingestion and analysis platform that:

• Collects Indicators of Compromise (IOCs) from public sources
• Stores and relates them in a PostgreSQL database
• Provides a REST API (FastAPI) for querying and analysis
• Includes a live dashboard for analysts
• Supports authentication to protect sensitive data

---

🚀 Features

✅ Real-time ingestion from:

• AlienVault OTX
• AbuseIPDB
• PhishTank

✅ Structured PostgreSQL database schema for:

• IPs, Malware, Hashes, URLs, Threat Sources, and Attack Timeline

✅ REST API built with FastAPI:

• Query threat data, recent attacks, and search by IP

✅ Analyst dashboard (HTML + Chart.js):

• View live attack logs and top malware family charts

✅ Token-based Authentication (JWT):

• Protects critical API endpoints from unauthorized access

---

📦 Tech Stack

Layer	Technology
Ingestion	Python + requests + schedule
Database	PostgreSQL
API Layer	FastAPI
Auth	JWT + passlib
Frontend	HTML + Bootstrap + Chart.js
Deployment	Uvicorn (local)

---

📁 Project Structure

📦 threat-intel-platform/
├── threat_ingest_realtime.py       # Ingests threat feeds into PostgreSQL
├── main.py                         # FastAPI app (API routes + JWT auth)
├── dashboard.html                  # Web-based analyst dashboard (HTML + Chart.js)
├── requirements.txt                # Python dependencies
└── README.md                       # You're here!

---

⚙️ Getting Started

1. Clone the repo

git clone https://github.com/yourusername/threat-intel-platform.git
cd threat-intel-platform

2. Installing Dependencies

pip install -r requirements.txt

3. Setting up the PostgreSQL database called

threat_intel_db

4. To run the ingestion script

python threat_ingest_realtime.py

5. after that, for running the FASTAPI server

uvicorn main:app --reload

---

Now visit:

API Docs: http://127.0.0.1:8000/docs

Dashboard: http://127.0.0.1:8000/dashboard

---

Built with 💻 by EdgeRunner007