Kali Dog Security CertStream

Hunts for homograph-attacks by monitoring newly created X.509 certificates using CertStream by Kali Dog Security.

Data Enrichment & Threat Intelligence · CertStream

Details

ID	`Kali Dog Security CertStream`
Provider	Cali Dog Security
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/netutils:1.0.0.10187688`

README

CertStream Integration Pack

Overview

The CertStream integration allows you to leverage the Certificate Transparency Log (CTL) network to get real-time alerts when new TLS/SSL certificates are issued. CertStream provides a stream of certificate transparency log data from dozens of CTL servers around the globe.

By integrating CertStream with Cortex XSOAR, you can build real-time detection and response workflows triggered by the issuance of TLS certificates that match specific criteria.

Configure CertStream Integration

Navigate to Integrations > CertStream
Click Add instance to create a new integration
Name your integration instance (e.g. my-certstream)
Enter the API endpoint (default is the public CertStream endpoint)
Set the Levenshtein distance threshold for matching domains (default is 0.9)
Set the Homograph list name of domain permutations to pull from
Click Test to validate the configuration
Click Done to save the integration

Sample Use Cases

Get real-time alerts when certificates are issued for your brand, trademarks, exec names, etc.
Detect type-squatting and potential phishing domains targeting your company.
Monitor certificates issued by public CAs.

Notifications

New Certificate Detected - Incident triggered when a new certificate matching defined filters is issued.

Configuration parameters

url — Server URL (required)
levenshtein_distance_threshold — Levenshtein distance threshold
longRunning — Long Running Instance
list_name — Homograph list name (required)
update_interval — Homograph list update time interval
proxy — Use system proxy settings

Commands (0)

This integration defines no commands.

Source

CertStream.py CertStream_test.py CertStream.yml CertStream_description.md

Download History Raw

import json
import pytest
import demistomock as demisto
from CertStream import get_homographs_list, levenshtein_distance, check_homographs


@pytest.mark.parametrize("list_name", [("testdomainlist")])
def test_get_homographs_list(list_name: str, mocker):
    mocker.patch.object(
        demisto,
        "internalHttpRequest",
        return_value={
            "body": json.dumps([{"id": "testdomainlist", "data": '{"test.com": "test.domain.com"}'}]),
            "headers": json.dumps({"statusCode": "200"}),
        },
    )
    result = get_homographs_list(list_name)

    assert result


@pytest.mark.parametrize(
    "original_string,reference_string,expected_result",
    [("test.domain.com", "test.domain.com", 0), ("test.domain.com", "", 15), ("paypal.com", "paypàl.com", 1)],
)
def test_levenshtein_distance(original_string: str, reference_string: str, expected_result: int):
    result = levenshtein_distance(original_string, reference_string)

    assert result == expected_result


@pytest.mark.parametrize(
    "domain, levenshtein_distance_threshold, expected_result",
    [("test.com", 0.3, True), ("another.org", 0.3, False), ("lest.com", 0.3, True)],
)
def test_check_homographs(domain: str, levenshtein_distance_threshold, expected_result, mocker, capfd):
    expected_result = expected_result
    homographs = {"test.com": ["best.com", "last.com"]}
    mocker.patch("CertStream.homographs", homographs)
    mocker.patch("CertStream.levenshtein_distance_threshold", levenshtein_distance_threshold)
    result = check_homographs(domain)

    assert result[0] == expected_result