Stamus

[Get Declaration of Compromises from Stamus Security Platform and build Incidents. Then get related artifacts, events and Host Insight information].

Network Security · Stamus

Details

IDStamus
ProviderStamus Networks
CategoryNetwork Security
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10116658

README

[Get Declaration of Compromises from Stamus Security Platform and build Incidents. Then get related artifacts, events and Host Insight information]
This integration was integrated and tested with version 39.0.1 of Stamus Security Platform

Configure Stamus in Cortex

Parameter Description Required
Stamus Central Server   True
API Key The API Key to use for connection True
Trust any certificate (not secure)   False
Use system proxy settings   False
Incident type   False
Fetch incidents   False
Maximum number of incidents per fetch   False
First fetch time   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

stamus-check-ioc

[Get events with IOC key/value filter]

Base Command

stamus-check-ioc

Input

Argument Name Description Required
indicator_key [Indicator of Compromise key]. Required
indicator_value [Indicator of Compromise value]. Required

Context Output

Path Type Description
StamusIntegration.IOC String [Fetch events matching an IOC.]
StamusIntegration.IOC.timestamp String [Timestamp of the event]
StamusIntegration.IOC.src_ip String [Source IP of the event]
StamusIntegration.IOC.dest_ip String [Destination IP of the event]
StamusIntegration.IOC.event_type String [Type of the event - can be multitude, example: HTTP,SMB,DNS,Flow,TLS,KRB5,FTP etc]

stamus-get-host-insight

[Get Host Insights information]

Base Command

stamus-get-host-insight

Input

Argument Name Description Required
ip [IP to get Host Insights information]. Required

Context Output

Path Type Description
StamusIntegration.HostInsights String [Fetch information about a host known by Host Insight module]
StamusIntegration.HostInsights.ip String [Stamus Host Insights IP address]
StamusIntegration.HostInsights.host_id.client_service.first_seen String [Timestamp of first time seen]
StamusIntegration.HostInsights.host_id.client_service String [Client network service detected]
StamusIntegration.HostInsights.host_id.services.proto String [Network services protocol]
StamusIntegration.HostInsights.host_id.services.port String [Network services port]
StamusIntegration.HostInsights.host_id.services.values.first_seen String [Network services for the corresponding application protocol first time seen]
StamusIntegration.HostInsights.host_id.services.values.last_seen String [Network services for the corresponding application protocol last time seen]
StamusIntegration.HostInsights.host_id.services.values.app_proto String [Network services application layer protocol]
StamusIntegration.HostInsights.host_id.services.services_count Number [Number of network services detected on the host]
StamusIntegration.HostInsights.host_id.client_service.name String [Type of client network service detected - can be HTTP,KRB5,TLS,DCERPC,SMB etc]
StamusIntegration.HostInsights.host_id.hostname.host String [Hostname detected on the host]
StamusIntegration.HostInsights.host_id.username.user String [Username detected loggin in on the host]
StamusIntegration.HostInsights.host_id.http.user_agent.agent String [HTTP User-Agent detected being used from the host]
StamusIntegration.HostInsights.host_id.tls.ja3.hash String [TLS JA3 hash detected being used from the host]
StamusIntegration.HostInsights.host_id.tls.ja3s.hash String [TLS JA3S hash detected being used from the host]

stamus-get-doc-events

[Get events for a Declaration of Compromise using the Stamus ID]

Base Command

stamus-get-doc-events

Input

Argument Name Description Required
id [Stamus ID used to get related information]. Required

Context Output

Path Type Description
StamusIntegration.RelatedEvents String [Get events for a Declaration of Compromise.]
StamusIntegration.RelatedEvents.timestamp String [Timestamp of the Stamus event]
StamusIntegration.RelatedEvents.stamus.asset String [Stamus asset]
StamusIntegration.RelatedEvents.offender String [Offender, against the Stamus asset]
StamusIntegration.RelatedEvents.killchain String [Killchain stage]
StamusIntegration.RelatedEvents.method String [Stamus method triggered]
StamusIntegration.RelatedEvents.info String [Extra Information]
StamusIntegration.RelatedEvents.src_ip String [Source IP of the event]
StamusIntegration.RelatedEvents.dest_ip String [Destination IP of the event]
StamusIntegration.RelatedEvents.app_proto String [Application protocol of the event]

Configuration parameters

  • url — Stamus Central Server (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time

Commands (3)

  • stamus-check-ioc

    [Get events with IOC key/value filter].

  • stamus-get-doc-events

    [Get events for a Declaration of Compromise using the Stamus ID].

  • stamus-get-host-insight

    [Get Host Insights information].

Source

Stamus.py Stamus_test.py Stamus.yml Stamus_description.md command_examples.txt
Download History Raw 
## Stamus Security Platform Integration Help

### Introduction

This integration connect XSOAR with Stamus Security Platform (SSP). It allows XSOAR
to fetch Declaration of Compromises from SSP and to enrich events with metadata and
Host Insights information.

### API key generation

To access the REST-API, a user first need to generate a unique token associated to its account. The API accesses are made on the behalf of a given user.

To do that, login to SCS and go under your account settings from the top right of the header’s menu.

From the left side panel, under User Settings, select Edit Token.

If you already generated a token for this account, it will be presented in the Token field, otherwise this field will be empty.

In both cases, to generate a new token, simply click the Regenerate button at the bottom of the page and you should see the Token field updated with a hash value such as 3064d9deadbeef36436daba5531e105123ec0fee.

### Setting up the Integration

To set up the integration you need to specify the base address of the server like `https://scs.my.org/` and the API keys.

Additional options are available such as `Don't Trust any certificate (not secure)` that you need to check if a
recognized certificate as not been deployed on the Stamus Central Server.