AlienVault Open Threat Exchange¶
The main settings for the AlienVault OTX integration determines how frequently the integration runs, how much history to initially download, how much history to use in an Intel file, and how much history to keep in the SQLite DB.
The initial download will retrieve OTX threat intel “pulses” back to the configured days set in the ‘download_history’ setting. Each consecutive download will only contain new pulses since the last successful download. If you change the ‘download_history’ setting, the integration resets, and on the next run it will retrieve all pulses back to the new setting.
do_notice
The do_notice
flag can be set based on the indicator type. It is set in the DB based on the settings when the indicator
is downloaded and is updated in the intel file each time it is written.
Tip
By default, only MD5 hash support is enabled on a Corelight Sensor. It is recommended that you use only one hash type. If you plan on using another hash type, update the configuration and enable the appropriate package on the sensor.
If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings
Settings¶
alienvault_otx:
enabled: false
interval_hours: 0
url: "https://otx.alienvault.com"
api_key:
debug: false
request_limit: 10000
download_history: 90 # days to download initially (max 90)
max_history: 365 # days to keep in the database
use_history: 90 # days to write to the intel file
# Enable indicator types below
indicator_type_url: true
do_notice_url: false
indicator_type_hostname: true
do_notice_hostname: false
indicator_type_domain: true
do_notice_domain: false
indicator_type_ipv4: true
do_notice_ipv4: false
indicator_type_md5: true
do_notice_md5: false
indicator_type_sha1: false
do_notice_sha1: false
indicator_type_sha256: false
do_notice_sha256: false
indicator_type_imphash: false
do_notice_imphash: false
indicator_type_sslcert: true
do_notice_sslcert: false
indicator_type_email: false
do_notice_email: false
Intel log¶
This integration will enrich the intel.log with content like the following:
{
"@path":"intel",
"@sensor":"Lab-AP200",
"@timestamp":"2023-01-06T05:13:38.841292Z",
"ts":"2023-01-06T05:13:38.841292Z",
"uid":"CNh51N3dSRfMZG1Pt4",
"id.orig_h":"195.133.40.86",
"id.orig_p":64910,
"id.resp_h":"192.168.13.20",
"id.resp_p":80,
"seen.indicator":"77.247.181.165",
"seen.indicator_type":"Intel::ADDR",
"seen.where":"Conn::IN_ORIG",
"matched": [
"Intel::ADDR"
],
"sources": [
"blocklist_de",
"cinsscore_ci_badguys",
"blocklist_net_ua",
"Mandiant",
"dshield_block"
],
}