Building a threat intelligence feed using the Twitter API and a bit of code

Re:Building a threat intelligence feed using the Twitter API... by snug on Saturday May 28, 2022 @09:55PM (#31545544)

With your jq piped to jq, you could just pipe it within jq

curl https://twitter.threatintel.rocks/ --silent | jq -r '.malicious_urls | .[]'

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by Robbedoes on Saturday May 28, 2022 @10:09PM (#31545615)

Thanks!

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by newman314 on Sunday May 29, 2022 @05:03PM (#31552854)

It appears that some URLs are cut off by Twitter. You might have to add some code to expand those URLs.

For example: https://xunmaus.xn--rvg

In the meantime, I'm using a modified command like so: `curl https://twitter.threatintel.rocks/ --silent | jq -r '.malicious_urls | .[]' | sort -u | grep -v …`

[ Parent | on HN ]

Re:Building a threat intelligence feed using the Twitter API... by Robbedoes on Monday May 30, 2022 @05:39AM (#31557156)

It seems this is only the case if it's a tweet that contains a retweet. These are now removed from the stream as they're not of relevance.

[ Parent | on HN ]