STIX/TAXII¶
The STIX/TAXII integration will download all requested indicators at each interval from the configured TAXII server.
This integration supports STIX version 2.1 and TAXII version 2.1, as provided by services like OpenTAXII.
Note
This integration was tested using OpenTAXII with TAXII version 2.1 and STIX version 2.1.
Supported Indicators¶
The supported indicator types are: IP Address (IPv4 & IPv6), Domain, URL, Email, FileName, FileHash (MD5, SHA-1, SHA-256), and UserName.
Example patterns for the supported indicator types:
ipv4-addr:value = '111.222.3.444'
ipv6-addr:value = '2001:0000:130F:0000:0000:09C0:876A:130B'
domain-name:value = 'malicious-domain.com'
url:value = 'http://malicious-site.com'
email-addr:value = 'phishing@example.com'
file:name = 'malware.exe'
file:hashes.MD5 = '2D3D5C19A771A3606019C8ED1CD47FB5'
file:hashes.'SHA-1' = 'C20C26D9F4F9BFF3CF4C29B5C1C30252D938EDDB'
file:hashes.'SHA-256' = '7f3d74d47b9fdbaaa9c9d3c8d5d1d0eb1918fe1bbaadfcb9bb3a08db6b98b25c'
user-account:account_login = 'Peter'
Settings¶
stix_taxii:
enabled: false
taxii_server_url: "" #TAXII server disscovery URL (required)
username: "" #TAXII server username (if not using access_token)
encrypted_password: "" #TAXII server password (if not using access_token)
access_token: "" #TAXII server access token
collection_name: "" #Name of the indicator collection to download data (required)
interval_hours: 24
request_limit: 10000 #If no limit is provided integration will use default_pagination_limit of the TAXII server
since_in_days: 7 #How many number of days data to download
min_confidence_score_doNotice: 90 #Minimum confidence score to set the do_notice flag "T", if enable_do_notice flag is set to true
debug: false
ignore_tls: false
indicator_type_ip_address: false
indicator_type_url: true
indicator_type_email_address: true
indicator_type_domain: true
indicator_type_filename: true
indicator_type_file_hash: true
indicator_type_username: true
enable_do_notice: true
username
(Optional) For basic authentication when not using anaccess_token
.encrypted_password
(Optional) For basic authentication when not using anaccess_token
. Use the Corelight-update CLI command with the inencrypt
switch to encrypt the password string. When using special characters in your password string, wrap it in quotes. See CLI commands for more details.access_token
Authentication using an access token. You must provide either anaccess_token
, or credentials for basic authentication using theusername
andencrypted_password
settings.If
interval_hours
is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings
The following is a sample input file created by this integration, using tab-separated values.
#fields indicators indicator_type meta.source meta.desc meta.url meta.do_notice confidence created_date modified_date
http://malicious.example.com/ Intel::URL - An indicator for detecting a suspicious URL pattern. - F - 2024-11-10T00:00:00Z 2024-11-10T00:00:00Z
http://malicious-site.com Intel::URL - This indicator represents a URL used by a known malicious domain. - F 80 2024-12-10T14:45:00Z 2024-12-10T14:45:00Z
http://suspicious-site2.example.com Intel::URL - Indicator for a suspicious URL. - F 77 2024-12-10T16:30:00Z 2024-12-10T16:30:00Z
165.123.45.22 Intel::ADDR - IP observed as a Malware Command and Control (aka C&C, C2) server. - T - 2024-09-18T13:43:17Z 2024-09-18T13:43:17Z
149.55.32.34 Intel::ADDR - IP observed running a known Offensive Security Tool, often used by penetration testers, security teams, and in some cases bad actors. - T - 2024-09-18T13:43:14Z 2024-09-18T13:43:14Z
168.128.130.123 Intel::ADDR - IP observed running a known Offensive Security Tool, often used by penetration testers, security teams, and in some cases bad actors. - T - 2024-09-18T13:43:19Z 2024-09-18T13:43:19Z
Intel log¶
This integration will enrich the intel.log with content like the following:
{
"@path":"intel",
"@sensor":"Lab-AP200",
"@timestamp":"2023-01-06T05:13:38.841292Z",
"ts":"2023-01-06T05:13:38.841292Z",
"uid":"CNh51N3dSRfMZG1Pt4",
"id.orig_h":"195.133.40.86",
"id.orig_p":64910,
"id.resp_h":"192.168.13.20",
"id.resp_p":80,
"seen.indicator":"77.247.181.165",
"seen.indicator_type":"Intel::ADDR",
"seen.where":"Conn::IN_ORIG",
"matched": [
"Intel::ADDR"
],
"sources": [
"blocklist_de",
"cinsscore_ci_badguys",
"blocklist_net_ua",
"Mandiant",
"dshield_block"
],
}
If the ExtendIntel Zeek package is loaded, the intel.log will be enriched with additional content like the following:
{
"confidence": [99],
"desc": ["Mandiant Threat Intellegence"]
"url": ["https://advantage.mandiant.com/"],
}
Note
An indicator might not include all fields.