ThreatQ - Zeek export

These steps explain how to export Zeek indicators for use with an external threat detection system. Follow these instructions in the ThreatQ platform to export your data.

  1. Select the Settings icon > Exports.

    The Exports page appears with a table listing all exports in alphabetical order.

  2. Click Add New Export.

    The Connection Settings dialog box appears.

  3. Enter an Export Name.

  4. Click Next Step.

    The Output Format dialog box appears.

  5. Provide the following information:

    FIELD

    VALUE

    Which type of information would you like to export?

    Indicators

    Output Type

    text/plain

    Special Parameters

    indicator.status=Active&indicator.deleted=N

    Note

    You can edit the output format. This includes the ability to remove unwanted indicator types.

  6. Under Output Format Template, enter:

    #fields{$tab}indicator{$tab}indicator_type{$tab}meta.source{$tab}meta.url
    {foreach $data as $indicator}
    {$indicator_type=""}
    {$source_found=0}
    {if $indicator.type eq "CIDR Block"}{$indicator_type="Intel::SUBNET"}{/if}
    {if $indicator.type eq "IP Address"}{$indicator_type="Intel::ADDR"}{/if}
    {if $indicator.type eq "URL"}{$indicator_type="Intel::URL"}{/if}
    {if $indicator.type eq "Email Address"}{$indicator_type="Intel::EMAIL"}{/if}
    {if $indicator.type eq "FQDN"}{$indicator_type="Intel::DOMAIN"}{/if}
    {if $indicator.type eq "MD5"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator.type eq "SHA-1"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator.type eq "SHA-256"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator.type eq "SHA-384"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator.type eq "SHA-512"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator.type eq "Filename"}{$indicator_type="Intel::FILE_HASH"}{/if}
    {if $indicator_type ne ""}
    {$indicator.value}{$tab}{$indicator_type}{$tab}{foreach $indicator.Sources item=source name=Sources}{if $smarty.foreach.Sources.first == true}
    {$source.value}{$source_found=1}{/if}{/foreach}{if $source_found == 0}-{/if}
    {$tab}https://{$http_host}/indicators/{$indicator.id}/details
    {/if}
    {/foreach}
    
  7. Click Save Settings.

  8. Under On/Off, toggle the switch to enable the export.

When finished, use the URL to download the intel data in Zeek format.