Musubu provides IP cyber threat intelligence APIs, the MusubuApp IP & Network Threat Intelligence Web Portal, and various integrations with platforms such as SIEM, SOAR, TIP, website (Wordpress) and more. Musubu APIs: Allows organizations to have easy access to detailed network information from their own endpoints efficiently and in bulk using simple queries to the Musubu API. With the latest version of the service, customers can easily assess the security risk posed by their publicly exposed networks, as well as survey their network environments to identify both potential threats and misleading false positive results. This allows customers to quickly filter out non-actionable [false positive] data and focus on the true threats to their organization. These are measured in the API results via: threat_potential_score_pct – Numeric threat score between 0-100. The Score is calculated using “blacklist class”, “blacklist neighbors”, number of recent observations and country of origin. threat_classification – Classification derived from “threat potential score pct” High – Threat score >70 Medium – Threat score from >40 but<70 Low – Any IP unlisted with a threat score <20 Nuisance – Threat score<40 blacklist_class – Field classifying the specific threat vector that has been identified. Contains one of the following values: apache, blacklisted, botnet, botnetcnc, brute force, compromised, ftp, http, imap, mail, malware, phishing, ransomware, shunned, sips, ssh, TOR, worm, zeus blacklist_class_cnt – Field providing the number of sources which have identified the address as malicious. blacklist_network_neighbors – Field providing the number of addresses present on the same subnet which have been identified as malicious. blacklist_observations – Field providing the number of observations (of this IP) in the last 90 days. As well, Musubu's KnownNetworks® data sets also show you the following for any IP address: - Network Name - Network Type - Network Group MusubuApp IP & Network Intelligence Web Portal: MusubuApp is a simple, highly-affordable web application that delivers practical, immediately usable threat intelligence around IP-driven cyber threats – the number one vector of cybercrime for businesses large and small. MusubuApp allows security and information technology (IT) professionals to quickly research, identify malicious servers and clients making connections with their websites, apps, mail servers, cloud servers, and other networked assets. MusubuApp allows users to search in bulk for suspicious IP addresses (IPs) and instantly see a detailed set of data about the IPs such as: The level and severity of cyber threat per IP The types of threats associated with each IP The total volume of cyber threats per IP Other risky IPs in the same subnet The network IPs belong to and what type of network As well, MusubuApp provides key usability features to help operators be more efficient when hunting threats: Bulk IP Search – Users can import up to 500 IPs via JSON or CSV for immediate search and monitoring. Users can also export any results to CSV or JSON for integration elsewhere. Watchlists – Users can create lists of IPs, name and describe them for alerting as well as subject them to advanced data analytics and intelligence modules. Geolocation – Users can see IP addresses and their threat profiles on Google Maps embedded in the application and click to street addresses for individual IPs. They can also search IPs straight onto the map. Tags – Users can tag IPs with useful labels and share them across the user community. Users can also map entire tag sets instantly. Trends & Analytics – Users can instantly gain intelligence from their Watchlists via modules that show things like new threats, rising threat ratings, time-series threat analytics, and much more. 3rd Party Integrations – MusubuApp accommodates things like “click-to-query” for sending entire Watchlist lists into other complementary cyber tools and platforms. As a result of its powerful, but simple features and low cost, MusubuApp is a natural complement to more expensive, enterprise tools such as Security Information and Event Management (SIEM), Threat Intelligence Platforms (TIP), Security Orchestration, Automation and Response (SOAR), and Incident Response (IR). Musubu IP Threat Data for Splunk: "NOTE: Request Free 7-Day Trial API Key via support@musubu.io" Use Musubu’s unique IP & Network cyber threat scoring and profiling API right in your Splunk instance to determine the following for each IP: - Cyber Threat Score: A 0-100 rating of how much of a cyber threat the IP may be based on the output of our analytics and algorithms. - Cyber Threat Classification: High-Medium-Nuisance-Low rating of an IPs cyber threat potential for quick identification. - Blacklist Class: The predominant cyber threat vector seen as associated with the IP address (e.g. Phishing, Ransomware, TOR, etc.). - Blacklist Count: The number of major IP blacklisting services that have blacklisted the IP address. - Blacklist Neighbors: The number of other IP addresses in the same subnet that have been blacklisted. - Blacklist Count: The number of times in the last 90 days the IP address has been blacklisted. Simply add one or more data sources to the Musubu Add-on and then you will be able to mouse over each IP address to see our threat profiling data. Use it to perform faster threat detection, threat identification, response, and mitigation. Leverage the “showipthreatdata” custom command within the add-on to make direct calls to the Musubu API from the Splunk search view. See example below - Musubu results for the specified IP are returned in a Tableview.