ThreatQ - Zeek export¶
These steps explain how to export Zeek indicators for use with an external threat detection system. Follow these instructions to export your data.
Select the Settings icon > Exports.
The Exports page appears with a table listing all exports in alphabetical order.
Click Add New Export.
The Connection Settings dialog box appears.
Enter an Export Name.
Click Next Step.
The Output Format dialog box appears.
Provide the following information:
FIELD
VALUE
Which type of information would you like to export?
Indicators
Output Type
text/plain
Special Parameters
indicator.status=Active&indicator.deleted=N
Note
You can edit the output format. This includes the ability to remove unwanted indicator types.
Under Output Format Template, enter:
#fields{$tab}indicator{$tab}indicator_type{$tab}meta.source{$tab}meta.url {foreach $data as $indicator} {$indicator_type=""} {$source_found=0} {if $indicator.type eq "CIDR Block"}{$indicator_type="Intel::SUBNET"}{/if} {if $indicator.type eq "IP Address"}{$indicator_type="Intel::ADDR"}{/if} {if $indicator.type eq "URL"}{$indicator_type="Intel::URL"}{/if} {if $indicator.type eq "Email Address"}{$indicator_type="Intel::EMAIL"}{/if} {if $indicator.type eq "FQDN"}{$indicator_type="Intel::DOMAIN"}{/if} {if $indicator.type eq "MD5"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-1"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-256"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-384"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-512"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "Filename"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator_type ne ""} {$indicator.value}{$tab}{$indicator_type}{$tab}{foreach $indicator.Sources item=source name=Sources}{if $smarty.foreach.Sources.first == true} {$source.value}{$source_found=1}{/if}{/foreach}{if $source_found == 0}-{/if} {$tab}https://{$http_host}/indicators/{$indicator.id}/details {/if} {/foreach}
Click Save Settings.
Under On/Off, toggle the switch to enable the export.
When finished, use the URL to download the intel data in Zeek format.