Add Threat Sourcing filter lists with malware blocking capabilities

- Added 3 new FilterList entries for threatsourcing.com
- Added Threat Sourcing maintainer entry
- Added FilterListViewUrl entries for all 3 lists
- Added syntax mappings (IPs, Domains, URLs)
- Added maintainer relationships
- Added malware tag associations
- Generated EF migration for database schema changes

Co-authored-by: collinbarrett <6483057+collinbarrett@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2025-07-29 22:22:35 +00:00 committed by Collin Barrett
parent eb4844676b
commit d7321bfab0
9 changed files with 88797 additions and 0 deletions

View file

@ -0,0 +1,155 @@
using Microsoft.EntityFrameworkCore.Migrations;
#nullable disable
#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
namespace FilterLists.Directory.Infrastructure.Migrations.Migrations
{
/// <inheritdoc />
public partial class AddThreatSourcingFilterLists : Migration
{
/// <inheritdoc />
protected override void Up(MigrationBuilder migrationBuilder)
{
migrationBuilder.InsertData(
table: "FilterList",
columns: new[] { "Id", "ChatUrl", "Description", "DonateUrl", "EmailAddress", "ForumUrl", "HomeUrl", "IssuesUrl", "LicenseId", "Name", "OnionUrl", "PolicyUrl", "SubmissionUrl" },
values: new object[,]
{
{ 2748, null, "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains IP addresses associated with malicious threats.", null, null, null, "https://www.threatsourcing.com/", null, 3, "Threat Sourcing IP Addresses", null, null, null },
{ 2749, null, "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains URLs associated with malicious threats.", null, null, null, "https://www.threatsourcing.com/", null, 3, "Threat Sourcing URLs", null, null, null },
{ 2750, null, "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This is a highly experimental list of URL strings for potential mitigation on HTTP proxy.", null, null, null, "https://www.threatsourcing.com/", null, 3, "Threat Sourcing HTTP Proxy Mitigation (Experimental)", null, null, null }
});
migrationBuilder.InsertData(
table: "Maintainer",
columns: new[] { "Id", "EmailAddress", "Name", "TwitterHandle", "Url" },
values: new object[] { 203, null, "Threat Sourcing", null, "https://www.threatsourcing.com/" });
migrationBuilder.InsertData(
table: "FilterListMaintainer",
columns: new[] { "FilterListId", "MaintainerId" },
values: new object[,]
{
{ 2748, 203 },
{ 2749, 203 },
{ 2750, 203 }
});
migrationBuilder.InsertData(
table: "FilterListSyntax",
columns: new[] { "FilterListId", "SyntaxId" },
values: new object[,]
{
{ 2748, (short)9 },
{ 2749, (short)2 },
{ 2750, (short)8 }
});
migrationBuilder.InsertData(
table: "FilterListTag",
columns: new[] { "FilterListId", "TagId" },
values: new object[,]
{
{ 2748, 6 },
{ 2749, 6 },
{ 2750, 6 }
});
migrationBuilder.InsertData(
table: "FilterListViewUrl",
columns: new[] { "FilterListId", "Id", "Primariness", "Url" },
values: new object[,]
{
{ 2748, 3080, (short)1, "https://www.threatsourcing.com/ipall.txt" },
{ 2749, 3081, (short)1, "https://www.threatsourcing.com/dnall.txt" },
{ 2750, 3082, (short)1, "https://www.threatsourcing.com/ppall.txt" }
});
}
/// <inheritdoc />
protected override void Down(MigrationBuilder migrationBuilder)
{
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2748, 203 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2749, 203 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2750, 203 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2748, (short)9 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2749, (short)2 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2750, (short)8 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2748, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2749, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2750, 6 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2748, 3080 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2749, 3081 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2750, 3082 });
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2748);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2749);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2750);
migrationBuilder.DeleteData(
table: "Maintainer",
keyColumn: "Id",
keyValue: 203);
}
}
}

View file

@ -20369,6 +20369,30 @@ protected override void BuildModel(ModelBuilder modelBuilder)
HomeUrl = "https://netmountains.de/",
LicenseId = 3,
Name = "NETMOUNTAINS IP Blocklist"
},
new
{
Id = 2748,
Description = "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains IP addresses associated with malicious threats.",
HomeUrl = "https://www.threatsourcing.com/",
LicenseId = 3,
Name = "Threat Sourcing IP Addresses"
},
new
{
Id = 2749,
Description = "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains URLs associated with malicious threats.",
HomeUrl = "https://www.threatsourcing.com/",
LicenseId = 3,
Name = "Threat Sourcing URLs"
},
new
{
Id = 2750,
Description = "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This is a highly experimental list of URL strings for potential mitigation on HTTP proxy.",
HomeUrl = "https://www.threatsourcing.com/",
LicenseId = 3,
Name = "Threat Sourcing HTTP Proxy Mitigation (Experimental)"
});
});
@ -32558,6 +32582,21 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2747,
MaintainerId = 202
},
new
{
FilterListId = 2748,
MaintainerId = 203
},
new
{
FilterListId = 2749,
MaintainerId = 203
},
new
{
FilterListId = 2750,
MaintainerId = 203
});
});
@ -43965,6 +44004,21 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2747,
SyntaxId = (short)9
},
new
{
FilterListId = 2748,
SyntaxId = (short)9
},
new
{
FilterListId = 2749,
SyntaxId = (short)2
},
new
{
FilterListId = 2750,
SyntaxId = (short)8
});
});
@ -60377,6 +60431,21 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2747,
TagId = 20
},
new
{
FilterListId = 2748,
TagId = 6
},
new
{
FilterListId = 2749,
TagId = 6
},
new
{
FilterListId = 2750,
TagId = 6
});
});
@ -63273,6 +63342,12 @@ protected override void BuildModel(ModelBuilder modelBuilder)
Id = 202,
Name = "NETMOUNTAINS® Group GmbH",
Url = "https://netmountains.de/"
},
new
{
Id = 203,
Name = "Threat Sourcing",
Url = "https://www.threatsourcing.com/"
});
});
@ -88160,6 +88235,30 @@ protected override void BuildModel(ModelBuilder modelBuilder)
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://netmountains.de/feeds/ip_blacklist.txt"
},
new
{
FilterListId = 2748,
Id = 3080,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://www.threatsourcing.com/ipall.txt"
},
new
{
FilterListId = 2749,
Id = 3081,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://www.threatsourcing.com/dnall.txt"
},
new
{
FilterListId = 2750,
Id = 3082,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://www.threatsourcing.com/ppall.txt"
});
});

View file

@ -17998,5 +17998,26 @@
"id": 2747,
"licenseId": 3,
"name": "NETMOUNTAINS IP Blocklist"
},
{
"description": "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains IP addresses associated with malicious threats.",
"homeUrl": "https://www.threatsourcing.com",
"id": 2748,
"licenseId": 3,
"name": "Threat Sourcing IP Addresses"
},
{
"description": "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This list contains URLs associated with malicious threats.",
"homeUrl": "https://www.threatsourcing.com",
"id": 2749,
"licenseId": 3,
"name": "Threat Sourcing URLs"
},
{
"description": "Threat Sourcing is a collaborative project to collect and study threats as they present themselves on the Internet. This is a highly experimental list of URL strings for potential mitigation on HTTP proxy.",
"homeUrl": "https://www.threatsourcing.com",
"id": 2750,
"licenseId": 3,
"name": "Threat Sourcing HTTP Proxy Mitigation (Experimental)"
}
]

View file

@ -6182,5 +6182,17 @@
{
"filterListId": 2747,
"maintainerId": 202
},
{
"filterListId": 2748,
"maintainerId": 203
},
{
"filterListId": 2749,
"maintainerId": 203
},
{
"filterListId": 2750,
"maintainerId": 203
}
]

View file

@ -9110,5 +9110,17 @@
{
"filterListId": 2747,
"syntaxId": 9
},
{
"filterListId": 2748,
"syntaxId": 9
},
{
"filterListId": 2749,
"syntaxId": 2
},
{
"filterListId": 2750,
"syntaxId": 8
}
]

View file

@ -13114,5 +13114,17 @@
{
"filterListId": 2747,
"tagId": 20
},
{
"filterListId": 2748,
"tagId": 6
},
{
"filterListId": 2749,
"tagId": 6
},
{
"filterListId": 2750,
"tagId": 6
}
]

View file

@ -16881,5 +16881,23 @@
"id": 3079,
"primariness": 1,
"url": "https://netmountains.de/feeds/ip_blacklist.txt"
},
{
"filterListId": 2748,
"id": 3080,
"primariness": 1,
"url": "https://www.threatsourcing.com/ipall.txt"
},
{
"filterListId": 2749,
"id": 3081,
"primariness": 1,
"url": "https://www.threatsourcing.com/dnall.txt"
},
{
"filterListId": 2750,
"id": 3082,
"primariness": 1,
"url": "https://www.threatsourcing.com/ppall.txt"
}
]

View file

@ -1043,5 +1043,10 @@
"id": 202,
"name": "NETMOUNTAINS® Group GmbH",
"url": "https://netmountains.de"
},
{
"id": 203,
"name": "Threat Sourcing",
"url": "https://www.threatsourcing.com"
}
]