NTT Cyber Threat Sensor

Details

ID	`NTT Cyber Threat Sensor`
Provider	NTT Group
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Retrieve alerts and recommendations from NTT CTS
This integration was integrated and tested with version 1.0 of NTT Cyber Threat Sensor

Configure NTT Cyber Threat Sensor in Cortex

Parameter	Description	Required
APIKEY	The API key for accessing CTS over AWS	True
TENANT_ID	Tenant identification. UUID formatted string	True
DAYS_BACK	Days to fetch for the first time this application runs	True
ITEMS_TO_FETCH	Number of items to fetch each iteration (1 to 100)	True
SOARTOKEN	The unique key for accessing the alerts and active response recommendations	True
isFetch	Fetch incidents	False
incidentType	Incident type	False
BASEURL	The base URL for the backend to consume from	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ntt-cyber-threat-sensor-poll-blobs

Check if blobs is available

Base Command

ntt-cyber-threat-sensor-poll-blobs

Input

Argument Name	Description	Required
event_id	ID of the incident from whom to fetch blobs for	Required
timestamp	ISO timestamp for when alert was triggered	Required

Context Output

Path	Type	Description
CTS.FetchBlob	boolean	True if there are blobs to fetch
CTS.Blob.ID	string	ID of the incident
CTS.Blob.Status	string	hold to wait and release to run

Command Example

!ntt-cyber-threat-sensor-poll-blobs event_id=07be6916957da6dc0b4c7fbf6995b1e44dccb9e7 timestamp=2020-08-12T07:29:01.464841

Context Example

{
    "CTS": {
        "Blobs": {
            "ID": "07be6916957da6dc0b4c7fbf6995b1e44dccb9e7",
            "Status": "release"
        }
    }
}

Human Readable Output

CTS blob(s) was found and has been sceduled for download

ntt-cyber-threat-sensor-fetch-blobs

Collecting blobs, most commonly pcap from an incident

Base Command

ntt-cyber-threat-sensor-fetch-blobs

Input

Argument Name	Description	Required
event_id	ID of the incident from whom to fetch blobs for	Required

Context Output

Path	Type	Description
File.Size	number	The size of the file.
File.SHA1	string	The SHA1 hash of the file.
File.SHA256	string	The SHA256 hash of the file.
File.Name	string	The name of the file.
File.SSDeep	string	The SSDeep hash of the file.
File.EntryID	string	The entry ID of the file.
File.Info	string	File information.
File.Type	string	The file type.
File.MD5	string	The MD5 hash of the file.
File.Extension	string	The file extension.
CTS.HasBlob	boolean	If one or more blobs exist then True

Command Example

!ntt-cyber-threat-sensor-fetch-blobs event_id=07be6916957da6dc0b4c7fbf6995b1e44dccb9e7

Context Example

{
    "CTS": {
        "HasBlob": [
            false,
            true
        ]
    },
    "File": {
        "EntryID": "226@b969e30d-f6de-490a-8f35-81a8939b5b97",
        "Extension": "pcap",
        "Info": "application/vnd.tcpdump.pcap",
        "MD5": "f6362d15102678983db75e7b764d973f",
        "Name": "6f5f0353-9ff6-4544-b6d9-1741a9842445.pcap",
        "SHA1": "a031573de579dea138351bb6742887baf9a5bf5a",
        "SHA256": "22cf474ab9be274078f4fc3796a7893f2bed9fe7920a921593ea43b8a4705a9f",
        "SHA512": "a751c7b436755aea5d7bbe3bfd0bc2e5a1ff5ddf8aadd956b50df18acaba4a43d969105bf9d28b66f8d2f9dcd1add1c0f73a5c9e6ccb01f0e34924f52acebee8",
        "SSDeep": "12288:90nf6/GBLS0c9s+txFd9Ri6KSIb9zK9RmnM:Of6/OYs+9kSaJKHmnM",
        "Size": 567348,
        "Type": "pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 65535)"
    }
}

Human Readable Output

CTS blob(s) downloaded:
[‘6f5f0353-9ff6-4544-b6d9-1741a9842445.pcap’]

Configuration parameters

APIKEY — The API key for accessing CTS over AWS (required)
TENANT_ID — Tenant identification. UUID formatted string (required)
DAYS_BACK — Days to fetch for the first time this application runs (required)
ITEMS_TO_FETCH — Number of items to fetch each iteration (1 to 100) (required)
SOARTOKEN — The unique key for accessing the alerts and active response recommendations (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
BASEURL — The base URL for the backend to consume from (required)
insecure — Trust any certificate (not secure)

Commands (2)

ntt-cyber-threat-sensor-fetch-blobs
Collecting blobs, most commonly pcap from an incident
ntt-cyber-threat-sensor-poll-blobs
Check if blobs is available

Source

NTT_Cyber_Threat_Sensor.py NTT_Cyber_Threat_Sensor.yml NTT_Cyber_Threat_Sensor_description.md command_examples.txt

Download History Raw

commonfields:
  id: NTT Cyber Threat Sensor
  version: -1
name: NTT Cyber Threat Sensor
display: NTT Cyber Threat Sensor
category: Network Security
sectionorder:
- Connect
- Collect
provider: NTT Group
description: Retrieve alerts and recommendations from NTT CTS.
configuration:
- display: 'The API key for accessing CTS over AWS '
  name: APIKEY
  defaultvalue: ''
  type: 4
  required: true
  section: Connect
- display: Tenant identification. UUID formatted string
  name: TENANT_ID
  defaultvalue: <TENANT_ID>
  type: 0
  required: true
  section: Connect
- display: Days to fetch for the first time this application runs
  name: DAYS_BACK
  defaultvalue: 3
  type: 0
  required: true
  section: Collect
- display: Number of items to fetch each iteration (1 to 100)
  name: ITEMS_TO_FETCH
  defaultvalue: 20
  type: 0
  required: true
  section: Collect
- display: The unique key for accessing the alerts and active response recommendations
  name: SOARTOKEN
  defaultvalue: ''
  type: 4
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: The base URL for the backend to consume from
  name: BASEURL
  defaultvalue: https://cts.eu1.nttsecurity.io/v1
  type: 0
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
script:
  script: '-'
  type: python
  commands:
  - name: ntt-cyber-threat-sensor-poll-blobs
    arguments:
    - name: event_id
      required: true
      isArray: true
      description: ID of the incident from whom to fetch blobs for.
    - name: timestamp
      description: ISO timestamp for when alert was triggered.
      isArray: true
      required: true
    outputs:
    - contextPath: CTS.FetchBlob
      description: True if there are blobs to fetch.
      type: boolean
    - contextPath: CTS.Blob.ID
      description: ID of the incident.
      type: string
    - contextPath: CTS.Blob.Status
      description: Hold to wait and release to run.
      type: string
    description: Check if blobs is available
    execution: true
  - name: ntt-cyber-threat-sensor-fetch-blobs
    arguments:
    - name: event_id
      required: true
      description: ID of the incident from whom to fetch blobs for.
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Name
      description: The name of the file.
      type: string
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: string
    - contextPath: File.Info
      description: File information.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.Extension
      description: The file extension.
      type: string
    - contextPath: CTS.HasBlob
      description: If one or more blobs exist then True.
      type: boolean
    description: Collecting blobs, most commonly pcap from an incident
    execution: true
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)
defaultclassifier: NTT Cyber Threat Sensor - Classifier
defaultmapperin: NTT Cyber Threat Sensor - mapper