-
Notifications
You must be signed in to change notification settings - Fork 57
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into fix-homepage
- Loading branch information
Showing
334 changed files
with
12,236 additions
and
6,030 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # Bitsight | ||
|
|
||
| { align=right width=150 } | ||
|
|
||
| Bitsight connector for audit logs | ||
|
|
||
| ## Configuration | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `company_uuids` | `array` | The list of company uuids | | ||
| | `api_token` | `string` | The API Token to authenticate calls to the Bitsight API | | ||
|
|
||
| ## Triggers | ||
|
|
||
| ### [BETA] Fetch new findings from Bitsight | ||
|
|
||
| Get findings from a Bitsight | ||
|
|
||
| **Arguments** | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `frequency` | `integer` | Batch frequency in seconds | | ||
| | `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') | | ||
| | `intake_key` | `string` | Intake key to use when sending events | | ||
| | `batch_limit` | `integer` | Maximum number of events to send in a single batch | | ||
|
|
||
|
|
||
| ## Extra | ||
|
|
||
| Module **`Bitsight` v1.0.0** |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # Mimecast | ||
|
|
||
| { align=right width=150 } | ||
|
|
||
| Mimecast offers cloud-based email security, archiving, and continuity solutions to protect against cyber threats and ensure compliance. | ||
|
|
||
| ## Configuration | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `client_id` | `string` | Client ID | | ||
| | `client_secret` | `string` | Client Secret | | ||
|
|
||
| ## Triggers | ||
|
|
||
| ### [BETA] Fetch new email events from Mimecast | ||
|
|
||
| Mimecast - Email Security | ||
|
|
||
| **Arguments** | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `frequency` | `integer` | Batch frequency in seconds | | ||
| | `chunk_size` | `integer` | The size of chunks for the batch processing | | ||
| | `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') | | ||
| | `intake_key` | `string` | Intake key to use when sending events | | ||
|
|
||
|
|
||
| ## Extra | ||
|
|
||
| Module **`Mimecast` v0.1.1** |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| # Nybble | ||
|
|
||
| { align=right width=150 } | ||
|
|
||
| [Nybble Hub](https://nybble-security.io) is the worldwide first blue team community which handles your alerts at a glance. | ||
|
|
||
| ## Configuration | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `nhub_url` | `string` | Nybble Hub Connector Base URL | | ||
| | `nhub_username` | `string` | Nybble Hub Connector username | | ||
| | `nhub_key` | `string` | Nybble Hub Connector Key to authenticate the requests | | ||
|
|
||
| ## Actions | ||
|
|
||
| ### Create Alert | ||
|
|
||
| Create an Alert into Nybble Hub | ||
|
|
||
| **Arguments** | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `alert_data` | `object` | Received alert, from Sekoia 'Get Alert' action | | ||
| | `rule` | `object` | Alert Rule from Rule Catalog, from Sekoia 'Get Rule' action | | ||
| | `events` | `array` | Related Events, from Sekoia 'Get The Alert Events' action | | ||
|
|
||
|
|
||
| **Outputs** | ||
|
|
||
| | Name | Type | Description | | ||
| | --------- | ------- | --------------------------- | | ||
| | `status` | `boolean` | | | ||
| | `details` | `string` | | | ||
|
|
||
|
|
||
| ## Extra | ||
|
|
||
| Module **`Nybble` v1.0.2** |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
123 changes: 3 additions & 120 deletions
123
_shared_content/intelligence_center/integrations/opencti.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,124 +1,7 @@ | ||
| # External integration: OpenCTI | ||
|
|
||
| ## Objective | ||
| The existing Sekoia connector for OpenCTI has been released in 2021 and is freely available on the OpenCTI Github repository. This connector is regularly updated and maintained by Filigran. | ||
|
|
||
| Collect Sekoia.io CTI feed in an existing self-managed OpenCTI instance for any operational purpose (such as CTI aggregation, dissemination, hunting...). | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - An operational OpenCTI instance with administrator privileges | ||
| - An active Sekoia.io licence with access to the CTI | ||
| - An access to Sekoia.io User Center with the permissions to create an API key with [**all CTI permissions**](https://docs.sekoia.io/getting_started/Permissions/#cti-permissions) | ||
|
|
||
| ## Configuration | ||
|
|
||
| 1. Add the following code **to the end** of **docker-compose.yml** file in the OpenCTI docker repository | ||
|
|
||
| ```YAML | ||
| connector-sekoia: | ||
| image: opencti/connector-sekoia:latest | ||
| environment: | ||
| - OPENCTI_URL=http://opencti:8080 | ||
| - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} | ||
| - CONNECTOR_ID=<Replace_by_email> | ||
| - CONNECTOR_TYPE=EXTERNAL_IMPORT | ||
| - CONNECTOR_NAME=SEKOIA.IO | ||
| - CONNECTOR_SCOPE=identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report,location,vulnerability,indicator,campaign,infrastructure,relationship | ||
| - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) | ||
| - CONNECTOR_UPDATE_EXISTING_DATA=false | ||
| - CONNECTOR_LOG_LEVEL=info | ||
| - SEKOIA_API_KEY=<Replace_by_Sekoia_API_key> | ||
| - SEKOIA_COLLECTION=d6092c37-d8d7-45c3-8aff-c4dc26030608 | ||
| - SEKOIA_START_DATE=2022-01-01 # Optional, the date to start consuming data from. Maybe in the formats YYYY-MM-DD or YYYY-MM-DDT00:00:00 | ||
| - SEKOIA_CREATE_OBSERVABLES=true # Create observables from indicators | ||
| restart: always | ||
| depends_on: | ||
| - opencti | ||
|
|
||
| volumes: | ||
| esdata: | ||
| s3data: | ||
| redisdata: | ||
| amqpdata: | ||
| ``` | ||
| 2. Replace the following parameters: | ||
| - `CONNECTOR_ID`= Replace_by_email or an UUID4 | ||
| - `CONNECTOR_SCOPE` = identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report,location,vulnerability,indicator,campaign,infrastructure,relationship => Sekoia Intelligence elements set to be exported in OpenCTI that can be chosen from this list | ||
| - `SEKOIA_API_KEY`= Sekoia API key with CTI_Permissions | ||
| - `SEKOIA_START_DATE`= <start_date_to_retrieve_feed> e.g. 2023-05-01 | ||
|
|
||
| 3. Build and launch Sekoia connector | ||
| - Build `docker-compose pull connector-sekoia` | ||
| - Run `docker-compose up -d connector-sekoia` | ||
|
|
||
| !!!note | ||
| Sekoia connector should be named **connector-sekoia** as described in the previous section. | ||
| To check all connectors available and set in the server, type `docker-compose ps`. | ||
|
|
||
| 4. Check if Sekoia connector is running | ||
| ``` | ||
| docker-compose ps connector-sekoia | ||
| ``` | ||
|
|
||
| ## Connect to OpenCTI | ||
|
|
||
| 1. In a Web browser, type the following URL and replace `server_IP` and `port` by their values: http://server_ip:port/dashboard | ||
| {: style="width: 40%; max-width: 40%"} | ||
|
|
||
| 2. Enter your login and password set in the **.env** file | ||
|
|
||
| ## Sekoia Intelligence in OpenCTI | ||
|
|
||
| 1. First of all, check if the connector is running and up to date. Go to Sekoia connector **Data > Connectors > Sekoia.io** | ||
| {: style="width: 60%; max-width: 60%"} | ||
|
|
||
| On this page, you can find the following information: | ||
|
|
||
| - `Update date`: Last update date of the connector in OpenCTI | ||
| - `Status`: Status of the connector in OpenCTI | ||
| - `Perimeter`: Sekoia Intelligence feed set for import in `docker-compose.yml` file under **CONNECTOR_SCOPE** | ||
| - `Last cursor`: **SEKOIA_START_DATE** set in `docker-compose.yml` file in base64 format | ||
|
|
||
| {: style="width: 80%; max-width: 80%"} | ||
|
|
||
| 2. Navigate the Sekoia Intelligence Feed | ||
|
|
||
| Here are the elements of the Sekoia feed that can be found on OpenCTI after export: | ||
|
|
||
| |OpenCTI|Sekoia.io| | ||
| |--|--| | ||
| |Analysis|Threat-reports| | ||
| |Observations|Sightings| | ||
| |Arsenal|Malwares| | ||
| |Techniques|Intrusion-sets| | ||
| |Data|Indicators| | ||
|
|
||
| 3. Find a Sekoia.io Indicator | ||
|
|
||
| Here is an example with an indicator: | ||
|
|
||
| - In **Sekoia.io**, search for the indicator `blog.google` in the Intelligence Page | ||
| {: style="width: 100%; max-width: 100%"} | ||
|
|
||
| - In **OpenCTI**, look for this indicator in the Data page | ||
| {: style="width: 100%; max-width: 100%"} | ||
|
|
||
| - The content of the indicator will look like the one below | ||
| {: style="width: 100%; max-width: 100%"} | ||
|
|
||
| ## Troubleshoot | ||
|
|
||
| |Issue|Action|Linux command| | ||
| |--|--|--| | ||
| |Space disk full|check the logs|docker logs <container-id>| | ||
| |Conflict with containers|list containers on server|docker-compose ps| | ||
|
|
||
| ## Other resources | ||
|
|
||
| [OpenCTI official documentation](https://github.com/OpenCTI-Platform/opencti) | ||
|
|
||
| [OpenCTI - Using Docker](https://docs.opencti.io/5.7.X/deployment/installation/#using-docker) | ||
|
|
||
| [OpenCTI - Connector Configuration](https://docs.opencti.io/5.8.X/deployment/connectors/#connector-configuration) | ||
| ## Sekoia Connector Details | ||
|
|
||
| The OpenCTI Github repository: [https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/sekoia](https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/sekoia) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.