Tool History

I wanted to share a simple tool I created. I call it the Simple Threat Intelligence Feed Puller, it is as the name suggests a simple way to pull some free and open-source threat intel feeds.

This tool originally started as a PowerShell script which I wanted to release but, I wanted it to be as “system agnostic” as possible. Foolish me wanted to write a PowerShell version and a Bash version, but it eventually struck me that a Python tool would be best if I was truly trying to reach a system agnostic tool.

This script just uses one very common external library - requests and uses a local library I made that comes with the repo. All the script really does is send GET requests to the URLs specified in threat_feeds.txt, parses the responses to grab the unique IP addresses and then spits them out into a file. Which the file can easily be used for various things.

My Usage

I use this tool is to check my network logs to see if local IP addresses have communicated with any known malicious IP addresses, and also I make a block list for both ingress and egress traffic on the edge firewall. I work mainly with Fortigates which have a very easy method of incorporating an external threat-feed which can be used as a regular address object when building policies.

Closing Thoughts

Currently this tool only pulls IPv4 addresses from some common threat feeds. Please feel free to email or DM me on Twitter if there is any questions or feedback.

Recently I’ve been working on trying to use less social media as I’m working on trying to be more focused on more important tasks and also to save my sanity. A problem arose, turns out I use social medial as an aggregate for news and blogs that I care about. I needed a way to keep updated more efficiently also not to rely on social media or email newsletters. This is where the fantastic Newsboat comes in.

RSS Readers and Modern Issues

If your not familiar with an RSS reader, it is a creation of the early web that is still prominently used to this day. It is a standardized way to receive updates from websites and also the main delivery method for podcasts.

I’ve been trying use RSS Readers to keep organized but a lot of modern RSS readers are in my opinion, horrendous. They are too focused on some UX that I have no idea what they are trying to accomplish. I was always left feeling that the RSS Readers are too noisy and unusable to what I’m trying to use it for.

The Advent of Newsboat

I forgot how I came into awareness of Newsboat, I’m sure it was from a blog or a video,but it definitely ticked all the boxes I wanted in an RSS reader.

• Easy to use
• Not dependent on a web frontend and not cloud-based
• Minimalist
• CLI focused
• Easy to incorporate into scripts

Newsboat has now become a part of my daily routine and I can quickly catch up with all my sites and blogs without leaving the terminal.

If you have been reading the Newboat site the requirements, you may have noticed that this is a Linux only package, what if you are using Windows? Well, your in luck, using WSL You can install Newsboat like any ol' regular Linux distro package.

Quick Rundown of using Newsboat

The Newsboat site does have some good documentation but I would still like to show how I normally use Newsboat.

When you install Newsboat it will create a new directory at ~/.newsboat there is a file called urls, this is where you put each RSS URL you want to follow in here, one line per entry.

You can write a custom config file for Newsboat to use, you can name it whatever it doesn’t need a specific file type either. I have mine saved as newsboat_config all the config file options are outlined on the docs. Now Newsboat wont automatically use the config file every time you launch it, you do have to specify the config file when you run it, example : newsboat -C ~/.newsboat/newsboat_config It would be wise to set this as an alias on your .bashrc or .zshrc. below is my alias

alias newsboat='newsboat -C ~/.newsboat/newsboat_config'

As an example config file, below is my config file if you do amass a large list of URLs, I do highly recommend upping the reload-threads, this will make a significant difference in speed when pulling the articles.

auto-reload yes
download-retries 4
error-log ~/.newsboat/error.log
keep-articles-days 90
notify-xterm yes
refresh-on-startup yes
reload-threads 6
save-path ~/saved_articles

# srcery newsboat
# https://github.com/srcery-colors/srcery-shell

# interface colors {{{

color info              color15 color235 bold
color listfocus         color10 color237
color listfocus_unread  color9  color237
color listnormal        color7  default
color listnormal_unread color15 default

# }}}

Closing thoughts

I do plan on making another blog on how to make a script that shoots out articles daily as a Teams webhook, as it turns out I am now using Newsboat for my job to aggregate security news. But I wanted to introduce the beauty of Newsboat first before I release that.

If you have any questions or concerns please feel free to email me.

Thanks.

If you work professionally in information security or in networking you more than likely know what a Next-generation Firewall (NGFW) is. NGFWs are mainly used in the enterprise world, the problem is, the costs of these NGFWs are also enterprise level. Hardware and license costs of these enterprise firewalls make them unfeasible for small/medium businesses and home network enthusiast. This all changes thanks OPNsense and Sunny Valley’s Sensei.

This blog post wont be extremely technical, I just feel that OPNsense and Sensei are not getting the attention they deserve and I wanted to make people aware of this amazing partnership that brings NGFW capabilities to small/medium businesses and the home.

What the Heck is a NGFW anyway?

The short and sweet, Next Generation Firewalls are relatively new compared to “traditional” network firewalls which are usually a stateful firewall. NGFWs bring a plethora of advanced security features which usually include: Web filter, App control, Intrusion Detection and Intrusion Prevention (IDS/IPS) and TLS/SSL Inspection and also provide more visibility into your network. This is not at all a definite list of capabilities, some NGFW vendors offer more or less features.

OPNsense

Now we get into the meat of it. OPNsense has been around for a while, they are a fork of the popular PFsense firewall software. OPNsense has a great doc listing the reasons for the fork, I can personally say I agree with every point listed on that doc.

I have been using OPNsense for about 3 months and have been loving it. OPNsense in my opinion has a stronger focus on making this firewall software more secure, capable and modern. I have used PFsense for a while before I switched to OPNsense, for some reason I’ve never fully enjoyed it to be honest. OPNsense also supports a fantastic ecosystem of plugins, this is how Sensei is installed which greatly enhances the core functionality of OPNsense, I will get into these features shortly.

My personal favorite benefits of using OPNsense.

Reasons I <3 OPNsense

• Open Source
• Installed on HardenedBSD
• Supports WireGuard
• Modern firewall capabilities
• NGFW Capabilities with Sensei
• Can be installed on almost any type of hardware
  • I have mine installed on a old Dell Optiplex

Sensei

Sensei is developed by Sunny Valley Networks and is installed on your OPNsense firewall via plugin, which then enables NGFW features. I believe they are planning on releasing on more platforms, but as of right now it is only on OPNsense.

Sensei does offer different levels of subscription tiers, each with its own additional features, but they do have free community edition, this is what I am currently using. To be honest the license for the additional tiers are priced pretty good for the features you get though.

Sensei Features

With Sensei installed you can now:

• Block/Monitor, even at granular levels

  • Apps and app categories
  • Websites and website categories

• View and receive great reports on network activity

  • Schedule reports to be emailed to you
  • See users/IP’s
  • See top categories
  • Get detailed session reports/logs

• Sensei’s database of threats is periodically updated always giving you protection on newly observed threats.

Caveat

There is one caveat that I do want you to be aware of, I can be sure I will receive hate mail for not mentioning it. OPNsense is 100% open source, Sensei is not 100% open source, per their FAQ

"

Is Sensei open source?

Sensei consists of two modules:

• PHP Code & Python Scripts which provide the Web User Interface Functionality. This part is open source.
• The Packet Engine coded in C++. This part is closed source.

"

With that being said please don’t let this be the reason you will not use it. Sensei is a powerful feature-set that is available for free on a security focused open source firewall.

Pleas feel free to email me or DM me on Twitter if you would like to contact me.

Intro

Hello and welcome to my first blog post. This is where I will try to post some interesting or noteworthy ideas that come across my mind. I’m pretty sure my posts will be pretty infrequent, but I will try to make some interesting posts. Please feel free to follow my RSS if you would like to be informed when I make a new post.

Expected Topics

• Security: Network Security, Dev Secops and other InfoSec musings
• Linux
• Python
• Sustainable tech usage
• Other random stuff

About Me

I guess a little about me would be good, My name is Angel Alvarez, I am currently a “SOC Engineer” at a reasonably sized data center company.

I’ve recently have taken coding more seriously now and I am finally getting the concepts and able to write some very amateur code, but hey, it works! I’ve been learning Python but recently I’ve also been playing around with Rust, and so far been loving it.

I have nothing really else to say, if you would like to send me a message please feel free to do so with e-mail or DM me on Twitter