Milli Tehdit İstihbarat Akışı
& Canlı REST / Webhook API

{ "event": "threat.detected", "event_id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "timestamp": "2026-08-21T02:45:00.000Z", "severity": "critical", "threat": { "domain": "garanti-bbva-kredi-onay.xyz", "url": "https://garanti-bbva-kredi-onay.xyz/giris", "ip": "194.26.29.112", "target_brand": "Garanti BBVA", "threat_type": "malicious_phishing", "confidence_score": 95, "summary": "Sahte Garanti BBVA mobil giriş ve SMS tek kullanımlık şifre tuzağı.", "tags": ["turkey-cyber-threat", "banking-phishing", "target:garanti bbva"] } }

import hmac import hashlib import os from flask import Flask, request, jsonify app = Flask(__name__) WEBHOOK_SECRET = os.getenv("OLTANOM_SECRET", "whsec_your_secret_key") @app.route('/webhook/oltanom', methods=['POST']) def handle_oltanom_webhook(): signature_header = request.headers.get('X-Oltanom-Signature', '') raw_payload = request.get_data() # HMAC-SHA256 İmza Doğrulaması computed_signature = 'sha256=' + hmac.new( WEBHOOK_SECRET.encode('utf-8'), raw_payload, hashlib.sha256 ).hexdigest() if not hmac.compare_digest(signature_header, computed_signature): return jsonify({"error": "Geçersiz İmza"}), 401 data = request.json event = data.get("event") threat = data.get("threat", {}) print(f"🚨 [ALARM] Oltanom Tehdit Bildirimi: {threat.get('domain')} -> Hedef: {threat.get('target_brand')}") # TODO: SOAR / Takedown tetikleme fonksiyonunuz return jsonify({"status": "received"}), 200 if __name__ == '__main__': app.run(port=8080)

const express = require('express'); const crypto = require('crypto'); const app = express(); const WEBHOOK_SECRET = process.env.OLTANOM_SECRET || 'whsec_your_secret_key'; app.post('/webhook/oltanom', express.json(), (req, res) => { const signature = req.headers['x-oltanom-signature'] || ''; const payloadStr = JSON.stringify(req.body); // HMAC-SHA256 İmza Doğrulaması const expectedSig = 'sha256=' + crypto.createHmac('sha256', WEBHOOK_SECRET) .update(payloadStr) .digest('hex'); if (signature !== expectedSig) { return res.status(401).json({ error: 'Geçersiz İmza' }); } const { event, threat } = req.body; console.log(`🚨 [ALARM] Oltanom Tehdit Bildirimi: ${threat.domain} -> Hedef: ${threat.target_brand}`); res.status(200).json({ status: 'received' }); }); app.listen(8080, () => console.log('Oltanom Webhook Alıcısı 8080 portunda aktif.'));