OpenCTI Feed Deprecated

Deprecated. Use OpenCTI Feed 4.X instead.

Data Enrichment & Threat Intelligence · OpenCTI Feed · Feed

Details

IDOpenCTI Feed
ProviderFiligran
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/opencti:1.0.0.41469
Supported ModulesAgentix XSIAM

README

Ingest indicator feeds from OpenCTI.
Compatible with OpenCTI v3 instances. For v4.* and grater OpenCTI versions use the OpenCTI Feed 4.X integration.

Configure OpenCTI Feed in Cortex

Parameter Description Required
apikey API Key True
base_url Base URL True
indicator_types Indicators Type to fetch True
max_indicator_to_fetch Max. indicators per fetch (default is 500) False
feed Fetch indicators False
feedReputation Indicator Reputation False
feedReliability Source Reliability True
feedExpirationPolicy   False
feedExpirationInterval   False
feedFetchInterval Feed Fetch Interval False
feedTags Tags False
feedBypassExclusionList Bypass exclusion list False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Indicator type parameter

Possible values that are supported in XSOAR and will be generated out of the box:

Types  
ALL  
User-Account  
Domain  
Email-Address  
File-md5  
File-sha1  
File-sha256  
HostName  
IPV4-Addr  
IPV6-Addr  
Registry-Key-Value  
URL  

The following types are supported in OpenCTI but are not supported out of the box in XSOAR. To pull these indicator types from OpenCTI you will need to either create dedicated classification and mapping and/or create corresponding indicator types in your XSOAR system.

Types
autonomous-system
cryptographic-key
cryptocurrency-wallet
email-subject
directory
file-name
file-path
mac-addr
mutex
pdb-path
process
registry-key-value
user-agent
windows-service-name
windows-service-display-name
windows-scheduled-task
x509-certificate-issuer
x509-certificate-serial-number

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

opencti-get-indicators


Gets indicators from the feed.

Base Command

opencti-get-indicators

Input

Argument Name Description Required
limit The maximum number of indicators to return per fetch. The default value is “50”. Optional
indicator_types The indicator types to fetch. Out of the box indicator types supported in XSOAR are: “User-Account”, “Domain”, “Email-Address”, “File-md5”, “File-sha1”, “File-sha256”, “HostName”, “IPV4-Addr”, “IPV6-Addr”, “Registry-Key-Value”, and “URL”. The rest will not cause automatic indicator creation in XSOAR. Please refer to the integration documentation for more information. The default is “ALL”. Optional
last_id The last ID from the previous call from which to begin pagination for this call. Optional

Context Output

Path Type Description
OpenCTI.Indicators.type String Indicator type.
OpenCTI.Indicators.value String Indicator value.
OpenCTI.LastRunID String the id of the last fetch to use pagination.

Command Example

!opencti-get-indicators limit=2 indicator_types=domain

Context Example

{
    "OpenCTI": {
        "Indicators": [
            {
                "type": "Domain",
                "value": "test.com"
            },
            {
                "type": "Domain",
                "value": "test1.com"
            }
        ],
        "LastRunID": "YXJyYXljb25uZWN0aW9uOjI="
    }
}

Human Readable Output

Indicators from OpenCTI

type value
Domain test.com
Domain test.com

opencti-reset-fetch-indicators


WARNING: This command will reset your fetch history.

Base Command

opencti-reset-fetch-indicators

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Context Example

{}
```

Human Readable Output

Fetch history deleted successfully

Configuration parameters

  • apikey — API Key (required)
  • base_url — Base URL (required)
  • indicator_types — Indicators Type to fetch (required)
  • max_indicator_to_fetch — Max. indicators per fetch (default is 500)
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy
  • feedExpirationInterval
  • feedFetchInterval — Feed Fetch Interval
  • feedTags — Tags
  • feedBypassExclusionList — Bypass exclusion list
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (2)

  • opencti-get-indicators

    Gets indicators from the feed.

  • opencti-reset-fetch-indicators

    WARNING: This command will reset your fetch history.

from FeedOpenCTI import get_indicators_command, fetch_indicators_command, get_indicators
from test_data.feed_data import RESPONSE_DATA, RESPONSE_DATA_WITHOUT_INDICATORS
from CommonServerPython import CommandResults
from pycti import StixCyberObservable


class StixObservable:
    def list(self):
        return self


class Client:
    temp = ''
    stix_cyber_observable = StixCyberObservable


def test_get_indicators(mocker):
    """Tests get_indicators function
    Given
        The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user.
    When
        - `fetch_indicators_command` or `get_indicators_command` are calling the get_indicators function
    Then
        - convert the result to indicators list
        - validate the length of the indicators list
        - validate the new_last_id that is saved into the integration context is the same as the ID returned by the
            command.
    """
    client = Client
    mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA)
    new_last_id, indicators = get_indicators(client, indicator_type=['registry-key-value', 'user-account'], limit=10)
    assert len(indicators) == 2
    assert new_last_id == 'YXJyYXljb25uZWN0aW9uOjI='


def test_fetch_indicators_command(mocker):
    """Tests fetch_indicators_command function
    Given
        The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user.
    When
        - Calling `fetch_indicators_command`
    Then
        - convert the result to indicators list
        - validate the length of the indicators list
    """
    client = Client
    mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA)
    indicators = fetch_indicators_command(client, indicator_type=['registry-key-value', 'user-account'], max_fetch=200)
    assert len(indicators) == 2


def test_get_indicators_command(mocker):
    """Tests get_indicators_command function
    Given
        The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user and 'limit': 2
    When
        - Calling `get_indicators_command`
    Then
        - convert the result to human readable table
        - validate the readable_output, raw_response.
    """
    client = Client
    args = {
        'indicator_types': 'registry-key-value,user-account',
        'limit': 2
    }
    mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA)
    results: CommandResults = get_indicators_command(client, args)
    assert len(results.raw_response) == 2
    assert "Indicators from OpenCTI" in results.readable_output


def test_get_indicators_command_with_no_data_to_return(mocker):
    """Tests get_indicators_command function with no data to return
    Given
        The following indicator types: 'registry-key-value', 'user-account' that were chosen by the user.
    When
        - Calling `get_indicators_command`
    Then
        - validate the response to have a "No indicators" string
    """
    client = Client
    args = {
        'indicator_types': ['registry-key-value', 'user-account']
    }
    mocker.patch.object(client.stix_cyber_observable, 'list', return_value=RESPONSE_DATA_WITHOUT_INDICATORS)
    results: CommandResults = get_indicators_command(client, args)
    assert "No indicators" in results.readable_output