Page Comparison

SDK identifier, the field is auto-filled with a random name. Change this to a name that describes the destination, for example, “Devo Destination.”

Apply filters that affect the output of the IoCs received from the source.

For example, you can select different confidence values, sort the output order, specify the number of search results, and select the desired fields to retrieve. It is possible to use a (*) character to receive all of the information from the source without any filters.

Specify the path to the main.py file of the Anomali / Devo SDK integration.

Specify the directory where all the Devo SSL certificates are stored. The Devo server address where the data is going to be sent and optionally the port (default 443).

Sample metadata:

{"endpoint": "collector-us.devo.io", "domain_cert":
"<domain>.crt", "domain_key": "<domain>.key", "chain_cert":
"chain.crt", "cert_path": "/home/ubuntu/AnomaliSDK/certs/",
"port": 443, "endpoint_timeout": 60, "rejections":
"not_allowed", "mode": "verbose"}

Select version 2.0.

The timeout for the SDK, the recommended and default value is 600 seconds.

Select Indicators Only.

Both the Only Changed and Full Snapshot options are supported. The recommended setting for the best performance is the Only Changed option.

endpoint ^mandatory

• For customers on the Devo US Cloud: collector-us.devo.io

• For customers on the Devo EU Cloud: collector-eu.devo.io

• For customers on dedicated instances, contact Devo support for this value.

The Devo endpoint where indicators are sent to.

domain_cert ^mandatory

<domain>.crt
Where <domain> is the name of the Devo domain

The name of the Devo domain X.509 domain certificate copied to the ThreatStream server.

domain_key ^mandatory

<domain>.key
Where <domain> is the name of the Devo domain

The name of the Devo domain X.509 domain key copied to the ThreatStream server.

chain_cert ^mandatory

chain.crt

The name of the Devo chain X.509 domain certificate copied to the ThreatStream server.

cert_path ^mandatory

File path

Path to the directory where the Devo X.509 certificates are located on the ThreatStream server.

port ^mandatory

Number

The port to connect to Devo on, typically 443.

endpoint_timeout ^mandatory

Number

The timeout in seconds applied to the connection to Devo.

rejections

not_allowed (default) or allowed

• If not_allowed - if any indicators do not match the data format required by Devo, no data will be sent to Devo.

• If allowed - any indicators that do not match the data format required by Devo will not be sent to Devo, while indicators that do match the required data format will be sent.

mode

verbose or no_verbose (default)

The level of detail that the plugin will output to the log files.

• If verbose- all details about the plugin activity and settings will be available in the log files.

• If no_verbose- minimal details will be written to the log files.