IOC Tools Multiple Accounts

[adem_netsys]

Hi guys,

I use free accounts of some IOC tools such as Virustotal, but as you know, these accounts have some query limits, and in order to overcome this, I want to create multiple accounts and loop them to switch to the other account when one of them is stuck in the limit in the playbook I created for reputation. Has anyone had this kind of experience before?

Thanks 

[mvatansever]

Hi,

You can solve this issue by adding a Decision mechanism. Within the playbook, you can implement a logic that checks the limit of the current account and switches to the next one when needed. Additionally, I recommend looking into the MISP platform. With MISP, you can perform unlimited IoC queries and access a broader threat intelligence database.

Hope this helps.

Thanks!

[ranjeet]

Hi @adem_netsys ,
If you use 2-3 configurations, we can easily switch to the second one if the first one reaches its limit using playboook. But if you have more than four configurations, it gets complicated to manage.