Kali Dog Security CertStream

Hunts for homograph-attacks by monitoring newly created X.509 certificates using CertStream by Kali Dog Security.

Data Enrichment & Threat Intelligence · CertStream

Details

ID	`Kali Dog Security CertStream`
Provider	Cali Dog Security
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/netutils:1.0.0.10187688`

README

CertStream Integration Pack

Overview

The CertStream integration allows you to leverage the Certificate Transparency Log (CTL) network to get real-time alerts when new TLS/SSL certificates are issued. CertStream provides a stream of certificate transparency log data from dozens of CTL servers around the globe.

By integrating CertStream with Cortex XSOAR, you can build real-time detection and response workflows triggered by the issuance of TLS certificates that match specific criteria.

Configure CertStream Integration

Navigate to Integrations > CertStream
Click Add instance to create a new integration
Name your integration instance (e.g. my-certstream)
Enter the API endpoint (default is the public CertStream endpoint)
Set the Levenshtein distance threshold for matching domains (default is 0.9)
Set the Homograph list name of domain permutations to pull from
Click Test to validate the configuration
Click Done to save the integration

Sample Use Cases

Get real-time alerts when certificates are issued for your brand, trademarks, exec names, etc.
Detect type-squatting and potential phishing domains targeting your company.
Monitor certificates issued by public CAs.

Notifications

New Certificate Detected - Incident triggered when a new certificate matching defined filters is issued.

Configuration parameters

url — Server URL (required)
levenshtein_distance_threshold — Levenshtein distance threshold
longRunning — Long Running Instance
list_name — Homograph list name (required)
update_interval — Homograph list update time interval
proxy — Use system proxy settings

Commands (0)

This integration defines no commands.

Source

CertStream.py CertStream_test.py CertStream.yml CertStream_description.md

Download History Raw

commonfields:
  id: Kali Dog Security CertStream
  version: -1
name: Kali Dog Security CertStream
display: Kali Dog Security CertStream
category: Data Enrichment & Threat Intelligence
provider: Cali Dog Security
description: Hunts for homograph-attacks by monitoring newly created X.509 certificates using CertStream by Kali Dog Security.
configuration:
- display: Server URL
  name: url
  type: 0
  defaultvalue: wss://certstream.calidog.io/
  required: true
  section: Connect
- display: Levenshtein distance threshold
  name: levenshtein_distance_threshold
  type: 0
  defaultvalue: 0.85
  required: false
  section: Collect
  additionalinfo: The threshold will set the minimum required similarity between the certificate domain and the input. Higher values will require more exact matches.
- defaultvalue: 'true'
  display: Long Running Instance
  hidden: true
  name: longRunning
  type: 8
  section: Connect
- display: Homograph list name
  name: list_name
  type: 0
  required: true
  section: Collect
  additionalinfo: The list name in which all the relevant homographs are stored on XSOAR
- display: Homograph list update time interval
  name: update_interval
  type: 0
  required: false
  section: Collect
  additionalinfo: Sets the amount of time in which the integration will refetch the list of homographs. Default is 30 minutes.
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Collect
script:
  script: ""
  type: python
  dockerimage: demisto/netutils:1.0.0.10187688
  longRunning: true
  subtype: python3
marketplaces:
- xsoar
fromversion: 6.10.0
tests:
- No tests