Threat Hunting cookbook

Every window and IOC type as JSON. No key, no signup, no per-caller throttling.

Windows: today · week · month · yearRefresh: 15 min

All of today's IOCs as JSON:

curl -s https://api.tweetfeed.live/v1/today | jq .

Filter by IOC type (url, domain, ip, sha256, md5):

curl -s https://api.tweetfeed.live/v1/today/url

Combine type and tag - this week's Cobalt Strike IPs:

curl -s https://api.tweetfeed.live/v1/week/ip/CobaltStrike

Response shape, one IOC per array element:

{
  "date": "2026-05-03 06:07:00",
  "user": "PhishStats",
  "type": "domain",
  "value": "evil.example.shop",
  "tags": ["#phishing"],
  "tweet": "https://x.com/PhishStats/status/..."
}

Full API referenceOpenAPI spec

The same four windows as CSV, straight off the data repo. Header: date,user,type,value,tags,tweet.

Windows: today · week · month · year

wget https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv
wget https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv
wget https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv

The latest IOCs as an item stream, for feed readers and no-code automations.

Refresh: 15 min

curl -s https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/rss.xml

• Ready-to-consume exports of the last 30 days.
• One indicator per line.
• For Pi-hole, AdGuard Home, hosts files, dnsmasq and BIND RPZ.
• For firewalls and IDS/SIEM tooling.

Window: 30 daysRefresh: 15 min

# Plain-text exports, rolling 30-day window, one indicator per line
curl -sfL https://api.tweetfeed.live/v1/blocklist/domains.txt   # bare domains (Pi-hole)
curl -sfL https://api.tweetfeed.live/v1/blocklist/hosts.txt     # 0.0.0.0 hosts file
curl -sfL https://api.tweetfeed.live/v1/blocklist/adguard.txt   # AdGuard Home
curl -sfL https://api.tweetfeed.live/v1/blocklist/dnsmasq.txt   # dnsmasq address= rules
curl -sfL https://api.tweetfeed.live/v1/blocklist/rpz.txt       # BIND RPZ zone
curl -sfL https://api.tweetfeed.live/v1/blocklist/ips.txt       # bare IPs
curl -sfL https://api.tweetfeed.live/v1/blocklist/urls.txt      # full URLs, not just hosts

• urls.txt is the exception: it carries the full URL, not the host.
• It also covers IOCs on shared infrastructure.
• Host-level blocking cannot reach those without collateral damage.
• These files are a 1:1 mirror of the feed, with no extra quality gate.
• Pair them with an allowlist.
• If change control won't deploy a single-reporter list, start with a subset.
• domains-corroborated.txt, ips-corroborated.txt, urls-corroborated.txt
• That subset is also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.
• Or start with nrd-domains.txt, a higher-signal subset.
• It holds newly registered domains already reported malicious.
• adguard.txt now has an AdGuard/uBlock metadata header (! comments).
• It replaces the generic # header.
• So it drops straight into a custom filter list.

Bad domains listBad IPs list

Rewrites a flat file every 15 minutes, ready for a firewall or proxy to reload.

Window: todayRefresh: 15 min

*/15 * * * * curl -sfL https://api.tweetfeed.live/v1/today/url \
  | jq -r '.[].value' | sort -u > /etc/blocklists/tweetfeed-urls.txt

Only the IPs tagged Cobalt Strike this week. Swap the tag for any of the tracked hashtags.

Window: week

curl -sL https://api.tweetfeed.live/v1/week/ip/CobaltStrike | jq -r '.[].value'

Tag index

• Every IOC published in the last 30 days by one handle, filtered server-side.
• A researcher handle is a valid path filter if you keep the leading @.

Window: month

curl -sL https://api.tweetfeed.live/v1/month/@malwrhunterteam \
  | jq -r '.[] | "\(.type)\t\(.value)\t\(.tags|join(","))"'

Researchers

Every IOC carries provenance. Resolve one back to the post it came from before you alert on it.

Window: today

curl -sL https://api.tweetfeed.live/v1/today \
  | jq -r '.[] | select(.value=="evil.example.com") | .tweet'

The daily clustering run, ranked by how many IOCs each campaign produced in the last 7 days.

Window: 30 daysRefresh: daily

curl -sL https://api.tweetfeed.live/v1/campaigns \
  | jq -r '.campaigns[] | select(.ioc_count_7d > 0)
           | "\(.ioc_count_7d)\t\(.confidence)\t\(.name)"' | sort -rn

Campaigns

A saved search that keeps the TweetFeed lookup current, in savedsearches.conf. Every query below reads from it.

Refresh: 15 min

[TweetFeed_today_lookup_refresh]
search = | inputlookup append=t external_lookup tweetfeed_today.csv \
         | outputlookup tweetfeed_today.csv
cron_schedule = */15 * * * *
dispatch.earliest_time = -15m
enableSched = 1

A subsearch turns the lookup into a filter, then groups the hits by source host so you see who reached what.

Window: today

index=proxy [
  | inputlookup tweetfeed_today.csv
  | where type IN ("url","domain")
  | rename value AS url
  | fields url
] | stats count, values(tags), values(tweet) by src_ip, url

Any DNS query in the last 7 days that resolved a TweetFeed domain, carrying the tags and the source tweet along for triage.

Window: week

index=dns sourcetype=dns:query [
  | inputlookup tweetfeed_week.csv
  | where type="domain" | rename value AS query | fields query
] | table _time, src_ip, query, [tweetfeed.tags], [tweetfeed.tweet]

Save this one as a Notable Event with severity=medium and trigger it as soon as count > 0 to turn it into a real-time alert.

Reads today.csv at query time - no connector, no ingestion cost - and joins it against DnsEvents.

Window: todayLookback: 24h

let TweetFeedDomains = externaldata(date:string, user:string, type:string, value:string, tags:string, tweet:string)
  [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv"]
  with (format="csv")
  | where type == "domain"
  | project Domain = value, Tags = tags, Tweet = tweet;
DnsEvents
| where TimeGenerated > ago(24h)
| where Name in (TweetFeedDomains | project Domain)
| join kind=leftouter TweetFeedDomains on $left.Name == $right.Domain
| project TimeGenerated, Computer, ClientIP, Name, Tags, Tweet

The same pattern over week.csv and SecurityEvent, to catch authentication from a flagged address.

Window: weekLookback: 7d

let TweetFeedIPs = externaldata(date:string, user:string, type:string, value:string, tags:string, tweet:string)
  [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
  with (format="csv")
  | where type == "ip"
  | project IPAddress = value, Tags = tags, Tweet = tweet;
SecurityEvent
| where TimeGenerated > ago(7d)
| where IpAddress in (TweetFeedIPs | project IPAddress)
| join kind=leftouter TweetFeedIPs on $left.IpAddress == $right.IPAddress
| project TimeGenerated, Computer, Account, IpAddress, Tags, Tweet

Joins the URL and domain rows against DeviceNetworkEvents. The domain_whitelist array at the top is where your trusted assets go.

Window: weekLookback: 30d

let MaxAge = ago(30d);
let domain_whitelist = pack_array(
'XXX' // Some URL/Domain you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type in('url','domain')
    | extend RemoteUrl = tostring(report[3])
    | where RemoteUrl !in(domain_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteUrl, Tag, Tweet
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp> MaxAge
    ) on RemoteUrl
) | project Timestamp, DeviceName, RemoteUrl, Tag, Tweet

Same join over the IP rows, with private ranges dropped by ipv4_is_private() so RFC1918 noise never fires.

Window: weekLookback: 30d

let MaxAge = ago(30d);
let IPaddress_whitelist = pack_array(
'XXX' // Some IP address you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'ip'
    | extend RemoteIP = tostring(report[3])
    | where RemoteIP !in(IPaddress_whitelist)
    | where not(ipv4_is_private(RemoteIP))
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteIP, Tag, Tweet
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp> MaxAge
    ) on RemoteIP
) | project Timestamp, DeviceName, RemoteIP, Tag, Tweet

Unions process, file and image-load events, so a flagged hash is caught whether it ran, landed on disk or was loaded into another process.

Window: weekLookback: 30d

let MaxAge = ago(30d);
let SHA256_whitelist = pack_array(
'XXX' // Some SHA256 hash to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'sha256'
    | extend SHA256 = tostring(report[3])
    | where SHA256 !in(SHA256_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project SHA256, Tag, Tweet
);
union (
    TweetFeed
    | join (
        DeviceProcessEvents
        | where Timestamp> MaxAge
    ) on SHA256
), (
    TweetFeed
    | join (
        DeviceFileEvents
        | where Timestamp> MaxAge
    ) on SHA256
), (
    TweetFeed
    | join (
        DeviceImageLoadEvents
        | where Timestamp> MaxAge
    ) on SHA256
) | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Tag, Tweet

The MD5 counterpart of the query above, for the samples reported without a SHA-256.

Window: weekLookback: 30d

let MaxAge = ago(30d);
let MD5_whitelist = pack_array(
'XXX' // Some MD5 hash to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'md5'
    | extend MD5 = tostring(report[3])
    | where MD5 !in(MD5_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project MD5, Tag, Tweet
);
union (
    TweetFeed
    | join (
        DeviceProcessEvents
        | where Timestamp> MaxAge
    ) on MD5
), (
    TweetFeed
    | join (
        DeviceFileEvents
        | where Timestamp> MaxAge
    ) on MD5
), (
    TweetFeed
    | join (
        DeviceImageLoadEvents
        | where Timestamp> MaxAge
    ) on MD5
) | project Timestamp, DeviceName, FileName, FolderPath, MD5, Tag, Tweet

Polls today.csv every 15 minutes and upserts into tweetfeed-iocs-*, keyed on type plus value so re-reported IOCs update in place.

Window: todayRefresh: 15 min

input {
  http_poller {
    urls => {
      tweetfeed => "https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv"
    }
    schedule => { every => "15m" }
    codec => plain
  }
}
filter {
  split { field => "message" }
  csv {
    columns => ["date","user","type","value","tags","tweet"]
    separator => ","
  }
  date { match => ["date","ISO8601"] target => "@timestamp" }
  mutate { remove_field => ["message","event"] }
}
output {
  elasticsearch {
    hosts => ["https://es:9200"]
    index => "tweetfeed-iocs-%{+YYYY.MM.dd}"
    document_id => "%{type}-%{value}"
    action => "update"
    doc_as_upsert => true
  }
}

A LOOKUP JOIN from your DNS index into the ingested IOCs, runnable straight from Kibana Discover or Lens.

Lookback: 24h

FROM logs-network-dns-*
| WHERE @timestamp > NOW() - 24h
| LOOKUP JOIN tweetfeed-iocs-* ON dns.question.name == value
| WHERE type == "domain"
| KEEP @timestamp, host.name, source.ip, dns.question.name, tags, tweet
| SORT @timestamp DESC
| LIMIT 1000

Fires whenever an internal endpoint resolves a TweetFeed domain. Save it under Stack Management → Watcher.

Interval: 15 min

{
  "trigger": { "schedule": { "interval": "15m" } },
  "input": {
    "search": {
      "request": {
        "indices": ["logs-network-dns-*"],
        "body": {
          "query": {
            "bool": {
              "filter": [
                {"range": {"@timestamp": {"gte": "now-15m"}}},
                {"terms": {"dns.question.name": {"index": "tweetfeed-iocs-*", "id": "domain", "path": "value"}}}
              ]
            }
          },
          "size": 100
        }
      }
    }
  },
  "condition": {"compare": {"ctx.payload.hits.total.value": {"gt": 0}}},
  "actions": {
    "log": {"logging": {"text": "TweetFeed DNS hit: {{ctx.payload.hits.total.value}} events"}}
  }
}

• For detection rules, tweetfeed-iocs-* also works as a value list.
• It is compatible with Elastic Security's value list exceptions.
• Same data, alert-routable.

QRadar holds the IOC list in a reference set. Create the set once, then refresh it from cron on the same 15 minute cadence as the feed.

Window: weekRefresh: 15 min

# 1. Create the set once. FIRST_SEEN plus a 7 day TTL ages entries out on its own.
curl -s -X POST -H "SEC: $QRADAR_TOKEN" -H 'Version: 13.1' \
  "https://$CONSOLE/api/reference_data/sets?name=TweetFeed_IPs&element_type=IP&time_to_live=7%20days&timeout_type=FIRST_SEEN"

# 2. Refresh it from the last 7 days. Run this from cron every 15 minutes.
curl -s https://api.tweetfeed.live/v1/week/ip \
  | jq '[.[].value]' \
  | curl -s -X POST -H "SEC: $QRADAR_TOKEN" -H 'Version: 13.1' \
      -H 'Content-Type: application/json' --data-binary @- \
      "https://$CONSOLE/api/reference_data/sets/bulk_load/TweetFeed_IPs"

• The set must exist before the first bulk load, or the API answers 404.
• The body is a bare JSON array, which is why jq wraps the values.
• Build one set per type: swap ip for domain, url, sha256 or md5.
• Use element_type=ALN for anything that is not an address.

REFERENCESETCONTAINS() tests any Ariel field against the set, so one rule covers every log source that carries an address.

Window: weekLookback: 24h

SELECT
  QIDNAME(qid) AS 'Event',
  sourceip AS 'Source',
  destinationip AS 'Destination',
  username AS 'User'
FROM events
WHERE REFERENCESETCONTAINS('TweetFeed_IPs', destinationip)
LAST 24 HOURS

• Save it as a saved search, then build a rule on top of it to alert.
• The function takes an optional third argument:
• the domain ID on multi-tenant consoles.

AQL reference data functions

• A MISP-format manifest with one Event per day and 365 days of history.
• On MISP 2.5.47 or newer, go to Sync Actions → List Feeds.
• Click Load default feed metadata and enable TweetFeed.
• On older instances, go to Sync Actions → Feeds → Add Feed.
• Give it the feed directory: MISP appends /manifest.json itself.

Window: 365 days

URL:           https://tweetfeed.live/misp
Source format: misp
Provider:      TweetFeed
Auto-pull:     yes
Default tags:  TweetFeed, tlp:clear, type:OSINT

Save, click Fetch and store all feed data to seed it, then enable Cron Jobs → Feed Pull for auto-refresh.

• Enrichment: the TweetFeed Lookup module in misp-modules 3.0.10 or newer.
• It works on expansion and hover, with no API key.
• It adds the reporter, source tweets, corroboration and campaign membership.
• It covers IP, domain, hostname, URL, MD5 and SHA-256 attributes.
• Enable Plugin.Enrichment_tweetfeed_enabled
• under Administration → Server Settings → Plugin settings.

STIX 2.1 indicators over a TAXII 2.1 endpoint, for OpenCTI, ThreatQ and anything else that speaks the standard.

Window: 365 daysMedia type: taxii+json 2.1

# 1. Discovery - lists the API root and its collections
curl -s https://api.tweetfeed.live/taxii2/ \
  -H 'Accept: application/taxii+json;version=2.1'

# 2. Poll everything added since a timestamp (delta sync)
COLL=b7dc78af-1d12-5059-898c-3f0e77636204
curl -s "https://api.tweetfeed.live/taxii2/root/collections/$COLL/objects/?added_after=2026-07-01T00:00:00Z" \
  -H 'Accept: application/taxii+json;version=2.1'

• Paginate with limit and next.
• An added_after poll returns indicators only.
• Every indicator references identity and marking-definition objects.
• Those were created with the collection, so they fall outside any recent window.
• Fetch them once by id from /objects/{id}/.
• Your platform can then resolve the attribution and the TLP:CLEAR marking.

TAXII reference

• One AI-clustered campaign, with its full IOC membership.
• A self-contained STIX 2.1 bundle.
• Contents: Identity, TLP:CLEAR marking, one Indicator per IOC.
• MISP: Sync Actions → Import → Import from... STIX 2.x.
• OpenCTI: Data → Import.

Window: 30 daysMedia type: stix+json 2.1

curl -s https://api.tweetfeed.live/v1/campaigns/tfc-6d1f6fb9260c.stix.json -o campaign.stix.json

• Get campaign ids from /v1/campaigns or the campaigns page.
• The bundle id is deterministic.
• Reimporting the same campaign adds no duplicate objects.
• This applies to platforms that dedupe by id.

Per-campaign export reference

• The external-import/tweetfeed connector reads the daily CSVs.
• It writes Observables and Indicators.
• The reporting researcher is kept as the author organization.

Window: 30 days by defaultType: external-import

services:
  connector-tweetfeed:
    image: opencti/connector-tweetfeed:latest
    environment:
      - OPENCTI_URL=http://opencti:8080
      - OPENCTI_TOKEN=ChangeMe
      - CONNECTOR_ID=ChangeMe
      - CONNECTOR_NAME=Tweetfeed
      - CONNECTOR_SCOPE=tweetfeed
      - TWEETFEED_INTERVAL=1
      - TWEETFEED_DAYS_BACK_IN_TIME=30
      - TWEETFEED_CREATE_INDICATORS=true
      - TWEETFEED_CREATE_OBSERVABLES=true
      - TWEETFEED_CONFIDENCE_LEVEL=25
    restart: always

• TWEETFEED_INTERVAL is in days.
• TWEETFEED_DAYS_BACK_IN_TIME sets how far back the first run reaches.
• To force a poll, open Data management → Connectors.
• Then reset the connector state.
• For a standards-based path, use the TAXII 2.1 collection above.
• It works in OpenCTI too.

Connector source and configuration

Ask IntelOwl whether an observable ever appeared in the feed, and get back the tags, the reporting handle and the original tweet.

Observables: ip, url, domain, hashMax TLP: CLEAR

Analyzer:    TweetFeed
Type:        observable
Observables: ip, url, domain, hash
Max TLP:     CLEAR

Parameters (both optional):
  time     today | week | month | year
  filter1  a tag (phishing, ransomware, CobaltStrike)
           or a handle (@1ZRR4H, @malwrhunterteam)

• The analyzer keeps a local copy of the last 30 days.
• It refreshes that copy daily, so lookups do not hit the API.
• Only time: year falls through to a live call.

IntelOwl analyzer configuration

• Detects DNS lookups to a TweetFeed-listed domain.
• Populate %TweetFeedDomains% from your Sigma processing pipeline.
• For example, a sigmac lookup expansion.

Window: weekLogsource: sysmon EventID 22

title: TweetFeed-listed Malicious Domain Resolution
id: f1c0c0d0-1111-4444-9999-aaaaaaaaaaaa
status: experimental
description: Detects DNS lookups to domains published by TweetFeed within the last week
references:
  - https://tweetfeed.live/
  - https://api.tweetfeed.live/v1/week/domain
author: TweetFeed
date: 2026/05/03
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 22
    QueryName|expand: '%TweetFeedDomains%'
  condition: selection
falsepositives:
  - Allowlisted internal infrastructure
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.004

The corpus as agent tools over the Model Context Protocol, so a coding or SOC agent can query it directly instead of scraping a CSV.

Transport: streamable HTTPTools: 13

claude mcp add --transport http tweetfeed https://mcp.tweetfeed.live/

• Fourteen tools. No key, no auth.
• query_iocs, check_url, check_ip, check_hash,
• list_recent_iocs, get_tag_info, get_trending,
• enrich_ioc, get_campaigns, get_campaign_iocs,
• get_trends, search, fetch and get_feed_status.

Agents page and config snippets