...
...
...
...
...
...
...
...
...
...
...
...
...
...
Table of Contents |
---|
minLevel | 2 |
---|
maxLevel | 2 |
---|
type | flat |
---|
|
Overview
This integration ingests Anomali Threat Indicators as Devo lookup tables that can be used for threat detection through Devo query enrichment and alerting.
...
Anomali-Devo SDK configuration
Copy the Anomali-Devo SDK to a directory on your Integrator server.
Copy the following Devo certificates from your Devo domain to the Integrator server:
Chain.crt
<your_domain>.crt
<your_domain>.key
Create a ThreatStream Integrator Destination
Rw ui steps macro |
---|
Log in to the Anomali ThreatStream Integrator application. Go to Destinations and create a new Anomali Integrator SDK Destination. Select the SDK option and click Add. Configure the following settings: Name | SDK identifier, the field is auto-filled with a random name. Change this to a name that describes the destination, for example, “Devo Destination.” |
---|
Indicator filter | Apply filters that affect the output of the IoCs received from the source. For example, you can select different confidence values, sort the output order, specify the number of search results, and select the desired fields to retrieve. It is possible to use a (*) character to receive all of the information from the source without any filters. |
---|
SDK executable command | Specify the path to the main.py file of the Anomali / Devo SDK integration. Info |
---|
This setting is only available in integrator version 6.9.x and earlier. For versions 7.x.x, this information is specified later in this procedure. |
|
---|
Metadata in JSON Format | Specify the directory where all the Devo SSL certificates are stored. The Devo server address where the data is going to be sent and optionally the port (default 443). Sample metadata: Code Block |
---|
{"endpoint": "collector-us.devo.io", "domain_cert":
"<domain>.crt", "domain_key": "<domain>.key", "chain_cert":
"chain.crt", "cert_path": "/home/ubuntu/AnomaliSDK/certs/",
"port": 443, "endpoint_timeout": 60, "rejections":
"not_allowed", "mode": "verbose"} |
Info |
---|
Check more info about the variables in the table below. |
|
---|
Integrator API version | Select version 2.0. |
---|
Timeout in seconds | The timeout for the SDK, the recommended and default value is 600 seconds. |
---|
Intelligence type | Select Indicators Only. |
---|
Indicator update mode | Both the Only Changed and Full Snapshot options are supported. The recommended setting for the best performance is the Only Changed option. |
---|
Key | Allowed values | Description |
---|
endpoint mandatory
| | The Devo endpoint where indicators are sent to. | domain_cert mandatory
| <domain>.crt Where <domain> is the name of the Devo domain
| The name of the Devo domain X.509 domain certificate copied to the ThreatStream server. | domain_key mandatory
| <domain>.key Where <domain> is the name of the Devo domain
| The name of the Devo domain X.509 domain key copied to the ThreatStream server. | chain_cert mandatory
| chain.crt
| The name of the Devo chain X.509 domain certificate copied to the ThreatStream server. | cert_path mandatory
| File path | Path to the directory where the Devo X.509 certificates are located on the ThreatStream server. | port mandatory
| Number | The port to connect to Devo on, typically 443. | endpoint_timeout mandatory
| Number | The timeout in seconds applied to the connection to Devo. | rejections
| not_allowed (default) or allowed
| If not_allowed - if any indicators do not match the data format required by Devo, no data will be sent to Devo. If allowed - any indicators that do not match the data format required by Devo will not be sent to Devo, while indicators that do match the required data format will be sent.
| mode
| verbose or no_verbose (default)
| The level of detail that the plugin will output to the log files. |
Save the Destination. If you are using version 6.9 or earlier, continue to the next section. If you are using version 7.x.x, the screen below is displayed to specify the SDK executable command.
Choose one of the following available plugins: Windows OS - Devo-Plugin-WinOS.exe Ubuntu 18 - Devo-Plugin-UbuntuOS-18x Ubuntu 20 - Devo-Plugin-UbuntuOS-20x CentOS 7 - Devo-Plugin-CentOS-7x CentOS 8 - Devo-Plugin-CentOS-8x
|
...
When the indicators are sent to Devo, a number of Lookup Tables lookup tables are created. You can verify that these lookups have been created from the Lookup Management management tab in Data Searchsearch menu:Image Removed
The integration creates five lookup tables:
Lookup table | Description |
---|
Anomali_IP_Address_Threat_Intelligence | Contains IP address indicators |
Anomali_URL_Threat_Intelligence | Contains URL indicators |
Anomali_FIle_Hash_Threat_Intelligence | Contains File Hash indicators |
Anomali_Email_Threat_Intelligence | Contains Email Address indicators |
Anomali_Domain_Threat_Intelligence | Contains Domain indicators |
To interact with a Lookup Tablelookup table, hover over a row and click the three dots that appear as shown in the screenshot below:
...
Query enrichment
The primary use of lookup table data is to enrich Devo queries that can in turn be transformed into alerts. To enrich a query:
Launch the Data Search menu.
Open the Devo table you want to query.
Compose your initial base query to isolate the data you would like to enrich.
Select the add column function from the toolbar in the data search screen.
...
Provide a Column Name.
Select custom as the operation type.
Select the Anomali lookup table and field you would like to use for the enrichment from the drop-down list
...
.
Add a new argument to select the field to correlate on. The data type of the selected field must match the data type of the key value in the selected Lookup Table.
Click Create Column.
The new column is added to the data search workspace.
Troubleshooting
The integration writes to a log file named sdk.info.log
in the /sdk/logging
directory on the Integrator server for troubleshooting purposes. This file contains:
...