AlienVault Open Threat Exchange

The main settings for the AlienVault OTX integration determines how frequently the integration runs, how much history to initially download, how much history to use in an Intel file, and how much history to keep in the SQLite DB.

The initial download will retrieve OTX threat intel “pulses” back to the configured days set in the ‘download_history’ setting. Each consecutive download will only contain new pulses since the last successful download. If you change the ‘download_history’ setting, the integration resets, and on the next run it will retrieve all pulses back to the new setting.

do_notice

The do_notice flag can be set based on the indicator type. It is set in the DB based on the settings when the indicator is downloaded and is updated in the intel file each time it is written.

Tip

By default, only MD5 hash support is enabled on a Corelight Sensor. It is recommended that you use only one hash type. If you plan on using another hash type, update the configuration and enable the appropriate package on the sensor.

If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings

Settings

alienvault_otx:
  enabled:                          false
  interval_hours:                   0
  url:                              "https://otx.alienvault.com"
  api_key:
  debug:                            false
  request_limit:                    10000
  download_history:                 90  # days to download initially (max 90)
  max_history:                      365 # days to keep in the database
  use_history:                      90 # days to write to the intel file
  # Enable indicator types below
  indicator_type_url:               true
  do_notice_url:                    false
  indicator_type_hostname:          true
  do_notice_hostname:               false
  indicator_type_domain:            true
  do_notice_domain:                 false
  indicator_type_ipv4:              true
  do_notice_ipv4:                   false
  indicator_type_md5:               true
  do_notice_md5:                    false
  indicator_type_sha1:              false
  do_notice_sha1:                   false
  indicator_type_sha256:            false
  do_notice_sha256:                 false
  indicator_type_imphash:           false
  do_notice_imphash:                false
  indicator_type_sslcert:           true
  do_notice_sslcert:                false
  indicator_type_email:             false
  do_notice_email:                  false

Intel log

This integration will enrich the intel.log with content like the following:

  {
    "@path":"intel",
    "@sensor":"Lab-AP200",
    "@timestamp":"2023-01-06T05:13:38.841292Z",
    "ts":"2023-01-06T05:13:38.841292Z",
    "uid":"CNh51N3dSRfMZG1Pt4",
    "id.orig_h":"195.133.40.86",
    "id.orig_p":64910,
    "id.resp_h":"192.168.13.20",
    "id.resp_p":80,
    "seen.indicator":"77.247.181.165",
    "seen.indicator_type":"Intel::ADDR",
    "seen.where":"Conn::IN_ORIG",
    "matched": [
      "Intel::ADDR"
    ],
    "sources": [
      "blocklist_de",
      "cinsscore_ci_badguys",
      "blocklist_net_ua",
      "Mandiant",
      "dshield_block"
    ],
  }