intrusion-detection/data

Data directory for allucanget-ids

This directory contains data files used by the allucanget-ids Intrusion Detection System application, including whitelists, blocklists, and other configuration files. The data files are organized into subdirectories for easier management and maintenance.

Data files

• whois cache: Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
• Cloudflare IPv4 list: Contains a list of Cloudflare IPv4 addresses from https://www.cloudflare.com/ips-v4, used for whitelisting traffic from Cloudflare services.
• Cloudflare IPv6 list: Contains a list of Cloudflare IPv6 addresses from https://www.cloudflare.com/ips-v6, used for whitelisting traffic from Cloudflare services.
• MikroTik RouterOS IPv4 Firewall rules: Current MikroTik RouterOS IPv4 firewall rules.
• MikroTik RouterOS IPv6 Firewall rules: Current MikroTik RouterOS IPv6 firewall rules.
• MikroTik RouterOS IPv4 address list: Current MikroTik RouterOS IPv4 address list.
• MikroTik RouterOS IPv6 address list: Current MikroTik RouterOS IPv6 address list.
• Openfactory Geofeed: Contains Openfactory IP addresses and associated geolocation data from https://openfactory.net/geofeed.csv. Used for identifying and whitelisting traffic from known Openfactory sources.
• PaloAlto Scanner IP list: List of known PaloAlto scanner IP addresses from https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity, used for whitelisting traffic from PaloAlto scanners. !NOTE: This list can not be scraped easily (Javascript-based), so it is maintained manually and may be outdated. Please verify the list against the official source if needed.