{ "name": "ti_abusech", "title": "AbuseCH", "version": "2.10.0", "release": "ga", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.", "type": "integration", "download": "/epr/ti_abusech/ti_abusech-2.10.0.zip", "path": "/package/ti_abusech/2.10.0", "icons": [ { "src": "/img/abusech2.svg", "path": "/package/ti_abusech/2.10.0/img/abusech2.svg", "title": "AbuseCH", "size": "512x512", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_abusech/ti_abusech-2.10.0.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_abusech/2.10.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/abusech-overview.png", "path": "/package/ti_abusech/2.10.0/img/abusech-overview.png", "title": "AbuseCH Overview Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-files.png", "path": "/package/ti_abusech/2.10.0/img/abusech-files.png", "title": "AbuseCH Files Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-urls.png", "path": "/package/ti_abusech/2.10.0/img/abusech-urls.png", "title": "AbuseCH URLs Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ti_abusech/2.10.0/LICENSE.txt", "/package/ti_abusech/2.10.0/changelog.yml", "/package/ti_abusech/2.10.0/manifest.yml", "/package/ti_abusech/2.10.0/validation.yml", "/package/ti_abusech/2.10.0/docs/README.md", "/package/ti_abusech/2.10.0/img/abusech-files.png", "/package/ti_abusech/2.10.0/img/abusech-overview.png", "/package/ti_abusech/2.10.0/img/abusech-urls.png", "/package/ti_abusech/2.10.0/img/abusech2.svg", "/package/ti_abusech/2.10.0/kibana/tags.yml", "/package/ti_abusech/2.10.0/data_stream/malware/lifecycle.yml", "/package/ti_abusech/2.10.0/data_stream/malware/manifest.yml", "/package/ti_abusech/2.10.0/data_stream/malware/sample_event.json", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/lifecycle.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/manifest.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/sample_event.json", "/package/ti_abusech/2.10.0/data_stream/threatfox/lifecycle.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/manifest.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/sample_event.json", "/package/ti_abusech/2.10.0/data_stream/url/lifecycle.yml", "/package/ti_abusech/2.10.0/data_stream/url/manifest.yml", "/package/ti_abusech/2.10.0/data_stream/url/sample_event.json", "/package/ti_abusech/2.10.0/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json", "/package/ti_abusech/2.10.0/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/2.10.0/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/2.10.0/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/2.10.0/kibana/tag/ti_abusech-security-solution-default.json", "/package/ti_abusech/2.10.0/data_stream/malware/fields/agent.yml", "/package/ti_abusech/2.10.0/data_stream/malware/fields/base-fields.yml", "/package/ti_abusech/2.10.0/data_stream/malware/fields/beats.yml", "/package/ti_abusech/2.10.0/data_stream/malware/fields/ecs.yml", "/package/ti_abusech/2.10.0/data_stream/malware/fields/fields.yml", "/package/ti_abusech/2.10.0/data_stream/malware/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/agent.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/beats.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/ecs.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/fields.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/agent.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/base-fields.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/beats.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/ecs.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/fields.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/agent.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/base-fields.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/beats.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/ecs.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/fields.yml", "/package/ti_abusech/2.10.0/data_stream/url/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/manifest.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/transform.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/manifest.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/transform.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/manifest.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/transform.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/manifest.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/transform.yml", "/package/ti_abusech/2.10.0/data_stream/malware/agent/stream/cel.yml.hbs", "/package/ti_abusech/2.10.0/data_stream/malware/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/2.10.0/data_stream/malware/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/agent/stream/cel.yml.hbs", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/2.10.0/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/2.10.0/data_stream/threatfox/agent/stream/cel.yml.hbs", "/package/ti_abusech/2.10.0/data_stream/threatfox/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/2.10.0/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/2.10.0/data_stream/url/agent/stream/cel.yml.hbs", "/package/ti_abusech/2.10.0/data_stream/url/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/2.10.0/data_stream/url/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/agent.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/base-fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/beats.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/ecs.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malware/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/agent.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/beats.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/ecs.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_malwarebazaar/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/agent.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/base-fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/beats.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/ecs.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_threatfox/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/agent.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/base-fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/beats.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/ecs.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/fields.yml", "/package/ti_abusech/2.10.0/elasticsearch/transform/latest_url/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "ti_abusech", "title": "AbuseCH API", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.", "inputs": [ { "type": "cel", "vars": [ { "name": "auth_key", "type": "password", "title": "Auth Key", "description": "AbuseCH API key. This is optional but recommended to avoid rate limiting.", "multi": false, "required": false, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "title": "Collect AbuseCH logs via API using Elastic Agent", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_abusech.malware", "ilm_policy": "logs-ti_abusech.malware-default_policy", "title": "AbuseCH Malware payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "AbuseCH Malware API endpoint", "multi": false, "required": true, "show_user": false, "default": "https://urlhaus-api.abuse.ch/v1/payloads/recent/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which the malware payloads will be pulled. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Use [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) in days, hours, or minutes (e.g 10d). Default `90d`.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malware" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "AbuseCH Malware payloads using Elastic Agent", "description": "Collect AbuseCH Malware payloads using Elastic Agent", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malware" }, { "type": "logs", "dataset": "ti_abusech.malwarebazaar", "ilm_policy": "logs-ti_abusech.malwarebazaar-default_policy", "title": "AbuseCH MalwareBazaar payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "AbuseCH MalwareBazaar API endpoint", "multi": false, "required": true, "show_user": false, "default": "https://mb-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which the payloads from MalwareBazaar will be pulled. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Use [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) in days, hours, or minutes (e.g 10d). Default `90d`.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malwarebazaar" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "AbuseCH MalwareBazaar payloads using Elastic Agent", "description": "Collect AbuseCH MalwareBazaar payloads using Elastic Agent", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malwarebazaar" }, { "type": "logs", "dataset": "ti_abusech.threatfox", "ilm_policy": "logs-ti_abusech.threatfox-default_policy", "title": "AbuseCH Threat Fox indicators", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "AbuseCH Threat Fox API endpoint", "multi": false, "required": true, "show_user": false, "default": "https://threatfox-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval for polling indicators from AbuseCH Threat Fox API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "integer", "title": "Initial Interval", "description": "How far back to look for indicators the first time the agent is started. Defaults to 7 days, can be any number between 1-7.", "multi": false, "required": true, "show_user": true, "default": 7 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Use [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) in days, hours, or minutes (e.g 10d). Default `90d`.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-threatfox" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "AbuseCH Threat Fox indicators using Elastic Agent", "description": "Collect AbuseCH Threat Fox indicators using Elastic Agent", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "threatfox" }, { "type": "logs", "dataset": "ti_abusech.url", "ilm_policy": "logs-ti_abusech.url-default_policy", "title": "AbuseCH URL logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "AbuseCH Active URL API", "description": "Active URL API fetches URLs that are either actively distributing malware or that have been added to URLhaus within the past 90 days.", "multi": false, "required": true, "show_user": false, "default": "https://urlhaus.abuse.ch/downloads/json" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval for polling indicators from AbuseCH data dump. As data dump is generated every 5 minutes, it should be greater than 5 minutes. Default `1h`.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-url" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "AbuseCH URL logs using Elastic Agent", "description": "Collect AbuseCH URL logs using Elastic Agent", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "url" } ] }