Kali Dog Security CertStream

Hunts for homograph-attacks by monitoring newly created X.509 certificates using CertStream by Kali Dog Security.

Data Enrichment & Threat Intelligence · CertStream

Details

ID	`Kali Dog Security CertStream`
Provider	Cali Dog Security
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/netutils:1.0.0.10187688`

README

CertStream Integration Pack

Overview

The CertStream integration allows you to leverage the Certificate Transparency Log (CTL) network to get real-time alerts when new TLS/SSL certificates are issued. CertStream provides a stream of certificate transparency log data from dozens of CTL servers around the globe.

By integrating CertStream with Cortex XSOAR, you can build real-time detection and response workflows triggered by the issuance of TLS certificates that match specific criteria.

Configure CertStream Integration

Navigate to Integrations > CertStream
Click Add instance to create a new integration
Name your integration instance (e.g. my-certstream)
Enter the API endpoint (default is the public CertStream endpoint)
Set the Levenshtein distance threshold for matching domains (default is 0.9)
Set the Homograph list name of domain permutations to pull from
Click Test to validate the configuration
Click Done to save the integration

Sample Use Cases

Get real-time alerts when certificates are issued for your brand, trademarks, exec names, etc.
Detect type-squatting and potential phishing domains targeting your company.
Monitor certificates issued by public CAs.

Notifications

New Certificate Detected - Incident triggered when a new certificate matching defined filters is issued.

Configuration parameters

url — Server URL (required)
levenshtein_distance_threshold — Levenshtein distance threshold
longRunning — Long Running Instance
list_name — Homograph list name (required)
update_interval — Homograph list update time interval
proxy — Use system proxy settings

Commands (0)

This integration defines no commands.

Source

CertStream.py CertStream_test.py CertStream.yml CertStream_description.md

Download History Raw

# CertStream Integration

## Overview

CertStream is a service that provides real-time certificate transparency log updates. This integration allows ingesting CertStream data into our platform to detect new domain certificates in real-time.

## Prerequisites

Before using the `Certstream` integration, ensure that you have completed the following steps:

1. **Create Domain's Homographs List**: Run the `Create list for PTH` playbook in the playground to generate a list of domains and their homographs or create the list manually with the expected format: 

```json
{
  "domain1": [
    "domain1_homograph1",
    "domain1_homograph2",
    "domain1_homograph2"
  ],
  "domain2": [
    "domain2_homograph1",
    "domain2_homograph2",
    "domain2_homograph3"
  ]
}
```

After the list is created in the valid format, proceed with configuring integration instance.

## Usage

The integration connects to the CertStream public API server and watch the certificate transparency log.

New TLS certificates are detected from the stream and checked against configured domain names (in the homograph list). Any matches generate an alert containing the certificate details.

## Troubleshooting

Ensure network connectivity that the public CertStream API server is up and running.

<https://certstream.calidog.io/>