OpenCTI Feed Deprecated
Deprecated. Use OpenCTI Feed 4.X instead.
Data Enrichment & Threat Intelligence · OpenCTI Feed · Feed
Details
| ID | OpenCTI Feed |
|---|---|
| Provider | Filigran |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.5.0 |
| Docker Image | demisto/opencti:1.0.0.41469 |
| Supported Modules | Agentix XSIAM |
README
Ingest indicator feeds from OpenCTI.
Compatible with OpenCTI v3 instances. For v4.* and grater OpenCTI versions use the OpenCTI Feed 4.X integration.
Configure OpenCTI Feed in Cortex
| Parameter | Description | Required |
|---|---|---|
| apikey | API Key | True |
| base_url | Base URL | True |
| indicator_types | Indicators Type to fetch | True |
| max_indicator_to_fetch | Max. indicators per fetch (default is 500) | False |
| feed | Fetch indicators | False |
| feedReputation | Indicator Reputation | False |
| feedReliability | Source Reliability | True |
| feedExpirationPolicy | False | |
| feedExpirationInterval | False | |
| feedFetchInterval | Feed Fetch Interval | False |
| feedTags | Tags | False |
| feedBypassExclusionList | Bypass exclusion list | False |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
Indicator type parameter
Possible values that are supported in XSOAR and will be generated out of the box:
| Types | |
|---|---|
| ALL | |
| User-Account | |
| Domain | |
| Email-Address | |
| File-md5 | |
| File-sha1 | |
| File-sha256 | |
| HostName | |
| IPV4-Addr | |
| IPV6-Addr | |
| Registry-Key-Value | |
| URL |
The following types are supported in OpenCTI but are not supported out of the box in XSOAR. To pull these indicator types from OpenCTI you will need to either create dedicated classification and mapping and/or create corresponding indicator types in your XSOAR system.
| Types |
|---|
| autonomous-system |
| cryptographic-key |
| cryptocurrency-wallet |
| email-subject |
| directory |
| file-name |
| file-path |
| mac-addr |
| mutex |
| pdb-path |
| process |
| registry-key-value |
| user-agent |
| windows-service-name |
| windows-service-display-name |
| windows-scheduled-task |
| x509-certificate-issuer |
| x509-certificate-serial-number |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
opencti-get-indicators
Gets indicators from the feed.
Base Command
opencti-get-indicators
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The maximum number of indicators to return per fetch. The default value is “50”. | Optional |
| indicator_types | The indicator types to fetch. Out of the box indicator types supported in XSOAR are: “User-Account”, “Domain”, “Email-Address”, “File-md5”, “File-sha1”, “File-sha256”, “HostName”, “IPV4-Addr”, “IPV6-Addr”, “Registry-Key-Value”, and “URL”. The rest will not cause automatic indicator creation in XSOAR. Please refer to the integration documentation for more information. The default is “ALL”. | Optional |
| last_id | The last ID from the previous call from which to begin pagination for this call. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| OpenCTI.Indicators.type | String | Indicator type. |
| OpenCTI.Indicators.value | String | Indicator value. |
| OpenCTI.LastRunID | String | the id of the last fetch to use pagination. |
Command Example
!opencti-get-indicators limit=2 indicator_types=domain
Context Example
{
"OpenCTI": {
"Indicators": [
{
"type": "Domain",
"value": "test.com"
},
{
"type": "Domain",
"value": "test1.com"
}
],
"LastRunID": "YXJyYXljb25uZWN0aW9uOjI="
}
}
Human Readable Output
Indicators from OpenCTI
type value Domain test.com Domain test.com
opencti-reset-fetch-indicators
WARNING: This command will reset your fetch history.
Base Command
opencti-reset-fetch-indicators
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
Command Example
#### Context Example
{}
```
Human Readable Output
Fetch history deleted successfully
Configuration parameters
apikey— API Key (required)base_url— Base URL (required)indicator_types— Indicators Type to fetch (required)max_indicator_to_fetch— Max. indicators per fetch (default is 500)feed— Fetch indicatorsfeedReputation— Indicator ReputationfeedReliability— Source Reliability (required)tlp_color— Traffic Light Protocol ColorfeedExpirationPolicy—feedExpirationInterval—feedFetchInterval— Feed Fetch IntervalfeedTags— TagsfeedBypassExclusionList— Bypass exclusion listinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (2)
-
opencti-get-indicatorsGets indicators from the feed.
-
opencti-reset-fetch-indicatorsWARNING: This command will reset your fetch history.
from FeedOpenCTI import get_indicators_command, fetch_indicators_command, get_indicators from test_data.feed_data import RESPONSE_DATA, RESPONSE_DATA_WITHOUT_INDICATORS from CommonServerPython import CommandResults from pycti import StixCyberObservable class StixObservable: def list(self): return self class Client: temp = '' stix_cyber_observable = StixCyberObservable def test_get_indicators(mocker): """Tests get_indicators function Given The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user. When - `fetch_indicators_command` or `get_indicators_command` are calling the get_indicators function Then - convert the result to indicators list - validate the length of the indicators list - validate the new_last_id that is saved into the integration context is the same as the ID returned by the command. """ client = Client mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA) new_last_id, indicators = get_indicators(client, indicator_type=['registry-key-value', 'user-account'], limit=10) assert len(indicators) == 2 assert new_last_id == 'YXJyYXljb25uZWN0aW9uOjI=' def test_fetch_indicators_command(mocker): """Tests fetch_indicators_command function Given The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user. When - Calling `fetch_indicators_command` Then - convert the result to indicators list - validate the length of the indicators list """ client = Client mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA) indicators = fetch_indicators_command(client, indicator_type=['registry-key-value', 'user-account'], max_fetch=200) assert len(indicators) == 2 def test_get_indicators_command(mocker): """Tests get_indicators_command function Given The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user and 'limit': 2 When - Calling `get_indicators_command` Then - convert the result to human readable table - validate the readable_output, raw_response. """ client = Client args = { 'indicator_types': 'registry-key-value,user-account', 'limit': 2 } mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA) results: CommandResults = get_indicators_command(client, args) assert len(results.raw_response) == 2 assert "Indicators from OpenCTI" in results.readable_output def test_get_indicators_command_with_no_data_to_return(mocker): """Tests get_indicators_command function with no data to return Given The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user. When - Calling `get_indicators_command` Then - validate the response to have a "No indicators" string """ client = Client args = { 'indicator_types': ['registry-key-value', 'user-account'] } mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA_WITHOUT_INDICATORS) results: CommandResults = get_indicators_command(client, args) assert "No indicators" in results.readable_output