STIX/TAXII

The STIX/TAXII integration will download all requested indicators at each interval from the configured TAXII server.

This integration supports STIX version 2.1 and TAXII version 2.1, as provided by services like OpenTAXII.

Note

This integration was tested using OpenTAXII with TAXII version 2.1 and STIX version 2.1.

Supported Indicators

The supported indicator types are: IP Address (IPv4 & IPv6), Domain, URL, Email, FileName, FileHash (MD5, SHA-1, SHA-256), and UserName.

Example patterns for the supported indicator types:

  • ipv4-addr:value = '111.222.3.444'

  • ipv6-addr:value = '2001:0000:130F:0000:0000:09C0:876A:130B'

  • domain-name:value = 'malicious-domain.com'

  • url:value = 'http://malicious-site.com'

  • email-addr:value = 'phishing@example.com'

  • file:name = 'malware.exe'

  • file:hashes.MD5 = '2D3D5C19A771A3606019C8ED1CD47FB5'

  • file:hashes.'SHA-1' = 'C20C26D9F4F9BFF3CF4C29B5C1C30252D938EDDB'

  • file:hashes.'SHA-256' = '7f3d74d47b9fdbaaa9c9d3c8d5d1d0eb1918fe1bbaadfcb9bb3a08db6b98b25c'

  • user-account:account_login = 'Peter'

Settings

stix_taxii:
  enabled: false
  taxii_server_url: ""               #TAXII server disscovery URL (required)
  username: ""                       #TAXII server username (if not using access_token)
  encrypted_password: ""             #TAXII server password (if not using access_token)
  access_token: ""                   #TAXII server access token
  collection_name: ""                #Name of the indicator collection to download data (required)
  interval_hours: 24
  request_limit: 10000               #If no limit is provided integration will use default_pagination_limit of the TAXII server
  since_in_days: 7                   #How many number of days data to download
  min_confidence_score_doNotice: 90  #Minimum confidence score to set the do_notice flag "T", if enable_do_notice flag is set to true
  debug: false
  ignore_tls: false
  indicator_type_ip_address: false
  indicator_type_url: true
  indicator_type_email_address: true
  indicator_type_domain: true
  indicator_type_filename: true
  indicator_type_file_hash: true
  indicator_type_username: true
  enable_do_notice: true
  • username (Optional) For basic authentication when not using an access_token.

  • encrypted_password (Optional) For basic authentication when not using an access_token. Use the Corelight-update CLI command with the in encrypt switch to encrypt the password string. When using special characters in your password string, wrap it in quotes. See CLI commands for more details.

  • access_token Authentication using an access token. You must provide either an access_token, or credentials for basic authentication using the username and encrypted_password settings.

  • If interval_hours is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See Configuration settings

The following is a sample input file created by this integration, using tab-separated values.

#fields  indicators                 indicator_type   meta.source    meta.desc                                                                                                                          meta.url     meta.do_notice     confidence      created_date           modified_date
http://malicious.example.com/        Intel::URL      -             An indicator for detecting a suspicious URL pattern.                                                                                    -              F                 -          2024-11-10T00:00:00Z   2024-11-10T00:00:00Z
http://malicious-site.com            Intel::URL      -             This indicator represents a URL used by a known malicious domain.                                                                       -              F                 80         2024-12-10T14:45:00Z   2024-12-10T14:45:00Z
http://suspicious-site2.example.com  Intel::URL      -             Indicator for a suspicious URL.                                                                                                         -              F                 77         2024-12-10T16:30:00Z   2024-12-10T16:30:00Z
165.123.45.22                        Intel::ADDR     -             IP observed as a Malware Command and Control (aka C&C, C2) server.                                                                      -              T                 -          2024-09-18T13:43:17Z   2024-09-18T13:43:17Z
149.55.32.34                         Intel::ADDR     -             IP observed running a known Offensive Security Tool, often used by penetration testers, security teams, and in some cases bad actors.   -              T                 -          2024-09-18T13:43:14Z   2024-09-18T13:43:14Z
168.128.130.123                      Intel::ADDR     -             IP observed running a known Offensive Security Tool, often used by penetration testers, security teams, and in some cases bad actors.   -              T                 -          2024-09-18T13:43:19Z   2024-09-18T13:43:19Z

Intel log

This integration will enrich the intel.log with content like the following:

{
  "@path":"intel",
  "@sensor":"Lab-AP200",
  "@timestamp":"2023-01-06T05:13:38.841292Z",
  "ts":"2023-01-06T05:13:38.841292Z",
  "uid":"CNh51N3dSRfMZG1Pt4",
  "id.orig_h":"195.133.40.86",
  "id.orig_p":64910,
  "id.resp_h":"192.168.13.20",
  "id.resp_p":80,
  "seen.indicator":"77.247.181.165",
  "seen.indicator_type":"Intel::ADDR",
  "seen.where":"Conn::IN_ORIG",
  "matched": [
    "Intel::ADDR"
  ],
  "sources": [
    "blocklist_de",
    "cinsscore_ci_badguys",
    "blocklist_net_ua",
    "Mandiant",
    "dshield_block"
  ],
}

If the ExtendIntel Zeek package is loaded, the intel.log will be enriched with additional content like the following:

{
  "confidence": [99],
  "desc": ["Mandiant Threat Intellegence"]
  "url": ["https://advantage.mandiant.com/"],
}

Note

An indicator might not include all fields.