在SOC的实践中，对安全事件的跟踪以及威胁溯源是安全预警和防御的重要步骤。目前安全社区和白帽黑客建立了多种事件情报的分享渠道，其中社交媒体是非常重要的组成部分，有很多组织和个人通过各类社交APP发布恶意软件，安全事件，漏洞和利用工具的相关信息。故而目前许多安全人员都开始通过SOCMINT（社交媒体情报）来辅助威胁跟踪和预警工作。由于国内外的法律和文化不同，目前国内的微博更重于舆情、安全事件的发布，而推特更重于漏洞，恶意软件等技术信息的发布，在威胁跟踪时可以根据自身的具体需求选取，这里介绍一些twitter中进行威胁情报采集的方法。

In the practice of SOC, it is an important step to track security incidents and trace threats. At present, the security community and white hat hackers have established a variety of event intelligence sharing channels, in which social media is a very important part. Many organizations and individuals publish information about malware, security incidents, vulnerabilities and tools through various social apps. Therefore, many security personnel begin to use socmin (Social Media Intelligence) to assist threat tracking and early warning. Due to the different laws and cultures at home and abroad, the current domestic microblog is more important than the release of public opinion and security events, while Twitter is more important than the release of vulnerability, malware and other technical information. When tracking threats, you can choose according to your specific needs. Here are some methods of collecting Threat Intelligence in twitter.

目前，您可以通过在现有威胁情报文本数据中建立单词云来提取搜索威胁情报所需的关键词。单词云是通过统计网络文本中频繁出现的关键词而产生的集合。python中的wordcloud库可以快速完成单词云的生成。