How to Enrich OPNsense Events with Threat Intel

Landon Lewis discusses how to enhance data analysis using Axiom by integrating open-source threat intelligence, which can transform volumetric data sources into valuable insights without compromising on data retention and storage. By utilizing Vector as a syslog aggregator, users can manage syslog payloads effectively, even when they deviate from standard protocols. The process involves defining enrichment tables using CSV files created via Python scripts, which contain data types such as IP, Domain, URL, Hash, and Email. The Vector Remap Language (VRL) is then employed to filter log messages, extract relevant fields, and compare them against the enrichment data to identify potential threats, adding enriched threat information to the logs when matches are found. This method offers the advantage of real-time data enrichment, better aligning with contemporary detection engineering efforts.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.