Overview
This integration ingests Anomali Threat Indicators as Devo lookup tables that can be used for threat detection through Devo query enrichment and alerting.
Use cases
Alerting - detects and alerts on potential security threats through correlation with other data types ingested into Devo. For example: firewall, proxy, or EDR logs.
Alert enrichment - adds contextual data about each entity and enriches security alerts.
The integration is available to all Devo customers with a valid Anomali subscription.
Benefits
Reduce dwell time - through the correlation of Anomali Threat Intelligence and machine-generated data from systems in the network, your security team can uncover threats that they would otherwise not know about and therefore reduce the dwell time of potential cyber-attacks.
Reduce mean-time-to-respond (MTTR) - enriched alerts provide your security team with additional context about detected threats. This context can help to reduce the time required to complete the triage and / or investigation of the alert, and provide a suitable response to mitigate the threat.
System requirements
In order to use this integration, you will need:
An active Anomali subscription.
The Anomali ThreatStream Integrator application deployed and configured in your environment:
Anomali recommends updating to the latest version of the integrator if possible before you set up the Devo destination. At a minimum, you must have a ThreatStream Integrator installed that supports SDK (v6.6 or later).
If the threat intelligence source for your integrator is ThreatStream OnPrem, the ThreatStream Integrator must be running v6.9.x or later.
An active Devo subscription.
A direct connection from the server hosting ThreatStream OnPrem.
Devo X.509 certificates. See this article for more information.
Configuration and setup
Download the Devo SDK destination from the Anomali Integration downloads page.
Anomali-Devo SDK configuration
Copy the Anomali-Devo SDK to a directory on your Integrator server.
Copy the following Devo certificates from your Devo domain to the Integrator server:
Chain.crt<your_domain>.crt<your_domain>.key
Create a ThreatStream Integrator Destination
Verifying that data is being processed
The Integrator web application displays the status of each destination. You can verify that data is being processed from the Sources menu and by checking the values displayed on your newly created destination.
Viewing the data in Devo
Lookup management
When the indicators are sent to Devo, a number of Lookup Tables are created. You can verify that these lookups have been created from the Lookup Management tab in Data Search menu:
The integration creates five lookup tables:
Lookup table | Description |
|---|---|
Anomali_IP_Address_Threat_Intelligence | Contains IP address indicators |
Anomali_URL_Threat_Intelligence | Contains URL indicators |
Anomali_FIle_Hash_Threat_Intelligence | Contains File Hash indicators |
Anomali_Email_Threat_Intelligence | Contains Email Address indicators |
Anomali_Domain_Threat_Intelligence | Contains Domain indicators |
To interact with a Lookup Table, hover over a row and click the three dots that appear as shown in the screenshot below:
Query enrichment
The primary use of lookup table data is to enrich Devo queries that can in turn be transformed into alerts. To enrich a query:
Launch the Data Search menu.
Open the Devo table you want to query.
Compose your initial base query to isolate the data you would like to enrich.
Select the add column function from the toolbar in the data search screen.
Provide a Column Name.
Select custom as the operation type.
Select the Anomali lookup table and field you would like to use for the enrichment from the drop-down list:
Add a new argument to select the field to correlate on. The data type of the selected field must match the data type of the key value in the selected Lookup Table.
Click Create Column.
The new column is added to the data search workspace.
Troubleshooting
The integration writes to a log file named sdk.info.log in the /sdk/logging directory on the Integrator server for troubleshooting purposes. This file contains:
NFO messages showing the status of the SDK destination.
The number of elements sent to Devo and the name of the target Devo Lookup Table.
The number of IoCs categorized as not active or false positive by Anomali as these will be removed from the Devo Lookup Table.
Errors encountered during the execution.
There is also a sdk.error.log file that contains more detail on any WARNING and ERROR messages logged.