Create your Own Automated TI Feed

If you are exhausted from following multiple Threat Intelligence related blogs manually or subscribing rss feeds to your email address, as a part of your day-to-day work, then maybe it is time you can create your own setup to get such Threat Intel feeds automatically along with a touch of AI.

5 Simple Steps:

1. Create a list of your Threat Intel related blogs and rss feed.
2. Create a Telegram bot.
3. Create and Setup Azure OpenAI Account.
4. Develop a Python code to communicate among webpage, Telegram bot and AI.
5. Create Azure Function to automate the process.

TI blog links along with Summary

Create a list of Threat Intel blogs

There can be multiple ways to gather such blogs. you can search it in web manually or you can use GPT to fetch such list.

Create a Telegram Bot

you can create a telegram bot using Telegram’s BotFather. You can refer this detailed blog written by Liu Zuo Lin

Create and Setup Azure OpenAI Account

1. Create an Azure Account
2. Create a subscription
3. Navigate to Azure AI Services and Create Azure OpenAI account

4. Navigate to Resource Management to get your Keys and Endpoint details which will be needed to make API calls to GPT model

5. Also you need to get access to Azure open AI by filling a form. you can refer this article for more details.

Develop a Python code

1. Important Libraries you need to import: openai, requests, os, load_dotenv, feedparser
2. you would need Bot token and channel id to send messages to Telegram. You can store both these things in .env file and fetch the data later in the code for better security.

3. you can use below code to load and pass the API key and endpoint value which will be used to call APIs later.

4. Then you need to parse the rss urls and navigate through the entries to check for the recent blogs published.

5. once you get the specific article link from the websites, you can pass it as a prompt to GPT to get a one-line summary. you can also give better prompts to get more details about the blog, threat actors, TTPs and IOCs.

6. Finally, you can send the message to your Telegram channel

Create Azure Function to automate the process

1. Install Azure Function core tools and vs code
2. Then you need to install Azure account, azure storage, azurite, azure function extensions in vscode
3. this article can be referred to setup the local environment.
4. Create a local workspace during the setup where all your files related to this project will be stored.

5. After checking the code locally, It can be deployed to the function app.

Make it a Time trigger Function app and this setup will automatically look for recent threat intel blogs and will send a message in your telegram.