Data Sources & Licenses
Lore gathers publicly published threat intelligence. All content belongs to its original authors and publishers, and each report in the library links back to its source. Lore stores report metadata, short excerpts and the indicators and techniques extracted from them; the full work stays with the publisher. Names and trademarks are used only to identify the source and do not imply endorsement.
Research and advisory publishers
| Source | What Lore uses | Credit / licence |
|---|---|---|
| CISA Cybersecurity Advisories CISA (U.S. Government) | Advisory titles, summaries and extracted indicators | U.S. Government work; see cisa.gov terms |
| NCSC UK Reports National Cyber Security Centre (UK) | Report titles, summaries and extracted indicators | Open Government Licence where stated; see ncsc.gov.uk |
| Microsoft Threat Intelligence Microsoft | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Google Threat Intelligence (Mandiant) Google | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| CrowdStrike Blog CrowdStrike | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Unit 42 Palo Alto Networks | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Cisco Talos Cisco | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Check Point Research Check Point | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Securelist Kaspersky | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| WeLiveSecurity Research ESET | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| SentinelLABS SentinelOne | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Sophos X-Ops Sophos | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Elastic Security Labs Elastic | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Huntress Blog Huntress | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| The DFIR Report The DFIR Report | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
| Volexity Threat Research Volexity | Report metadata, short excerpts and extracted indicators | Publisher's own terms |
Open datasets and feeds
| Source | What Lore uses | Credit / licence |
|---|---|---|
| MITRE ATT&CK The MITRE Corporation | Techniques, groups and their aliases | © The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation (ATT&CK Terms of Use) |
| MISP Galaxy (threat actors) MISP Project | Threat-actor names, aliases and descriptions | CC0 1.0 / BSD 2-Clause, as stated in the repository |
| SigmaHQ SigmaHQ community | Rule release notes | Detection Rule License (DRL) 1.1 |
| ThreatFox abuse.ch | Indicators of compromise linked to actors and malware | CC0 1.0, per abuse.ch terms of use |
| AlienVault OTX LevelBlue (AT&T Cybersecurity) | Indicators of compromise, when enabled | OTX terms of service |
Are you a publisher and want your content credited differently or removed? Use the content removal form or email support@lore-intel.com.