{ "name": "ti_abusech", "title": "abuse.ch", "version": "4.1.0", "release": "ga", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.", "type": "integration", "download": "/epr/ti_abusech/ti_abusech-4.1.0.zip", "path": "/package/ti_abusech/4.1.0", "icons": [ { "src": "/img/abusech2.svg", "path": "/package/ti_abusech/4.1.0/img/abusech2.svg", "title": "abuse.ch", "size": "512x512", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.1.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_abusech/ti_abusech-4.1.0.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_abusech/4.1.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/abusech-overview.png", "path": "/package/ti_abusech/4.1.0/img/abusech-overview.png", "title": "abuse.ch Overview Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-files.png", "path": "/package/ti_abusech/4.1.0/img/abusech-files.png", "title": "abuse.ch Files Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-urls.png", "path": "/package/ti_abusech/4.1.0/img/abusech-urls.png", "title": "abuse.ch URLs Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-softwares.png", "path": "/package/ti_abusech/4.1.0/img/abusech-softwares.png", "title": "abuse.ch Softwares and x509 Certificates Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-domains.png", "path": "/package/ti_abusech/4.1.0/img/abusech-domains.png", "title": "abuse.ch Domains and IP Addresses Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ti_abusech/4.1.0/LICENSE.txt", "/package/ti_abusech/4.1.0/changelog.yml", "/package/ti_abusech/4.1.0/manifest.yml", "/package/ti_abusech/4.1.0/validation.yml", "/package/ti_abusech/4.1.0/docs/README.md", "/package/ti_abusech/4.1.0/img/abusech-domains.png", "/package/ti_abusech/4.1.0/img/abusech-files.png", "/package/ti_abusech/4.1.0/img/abusech-overview.png", "/package/ti_abusech/4.1.0/img/abusech-softwares.png", "/package/ti_abusech/4.1.0/img/abusech-urls.png", "/package/ti_abusech/4.1.0/img/abusech2.svg", "/package/ti_abusech/4.1.0/kibana/tags.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/sample_event.json", "/package/ti_abusech/4.1.0/data_stream/malware/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/malware/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/malware/sample_event.json", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/sample_event.json", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/sample_event.json", "/package/ti_abusech/4.1.0/data_stream/threatfox/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/sample_event.json", "/package/ti_abusech/4.1.0/data_stream/url/lifecycle.yml", "/package/ti_abusech/4.1.0/data_stream/url/manifest.yml", "/package/ti_abusech/4.1.0/data_stream/url/sample_event.json", "/package/ti_abusech/4.1.0/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json", "/package/ti_abusech/4.1.0/kibana/dashboard/ti_abusech-68ac01ad-dddf-476c-9a54-8c33c1047e53.json", "/package/ti_abusech/4.1.0/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/4.1.0/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/4.1.0/kibana/dashboard/ti_abusech-d11a94be-9b9f-42f8-9fed-d5e89005f24d.json", "/package/ti_abusech/4.1.0/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/malware/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/agent.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/base-fields.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/beats.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/ecs.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/fields.yml", "/package/ti_abusech/4.1.0/data_stream/url/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/transform.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/transform.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/transform.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/transform.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/transform.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/manifest.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/transform.yml", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/ja3_fingerprints/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/data_stream/malware/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/malware/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/malware/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/sslblacklist/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/data_stream/threatfox/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/threatfox/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/data_stream/url/agent/stream/cel.yml.hbs", "/package/ti_abusech/4.1.0/data_stream/url/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/4.1.0/data_stream/url/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malware/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_malwarebazaar/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_sslblacklist/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_threatfox/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/agent.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/base-fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/beats.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/ecs.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/fields.yml", "/package/ti_abusech/4.1.0/elasticsearch/transform/latest_url/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "ti_abusech", "title": "abuse.ch API", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.", "inputs": [ { "type": "cel", "vars": [ { "name": "auth_key", "type": "password", "title": "Auth Key", "description": "abuse.ch Auth Key. This is required for authentication for all API requests. See [documentation](https://abuse.ch/blog/community-first/) for details.", "multi": false, "required": true, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "title": "Collect abuse.ch logs via API", "description": "Collect abuse.ch logs via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "beta" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_abusech.ja3_fingerprints", "ilm_policy": "logs-ti_abusech.ja3_fingerprints-default_policy", "title": "JA3 Fingerprints", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch SSLBL API to collect active malicious JA3 fingerprints identified by SSLBL.", "multi": false, "required": true, "show_user": false, "default": "https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the SSLBL API. Supported units for this parameter are h/m/s. Example `24h`. As data dump is generated every 5 minutes, it should be greater than 5 minutes.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-ja3_fingerprints" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "JA3 Fingerprints", "description": "Collect malicious JA3 fingerprints from abuse.ch SSLBL.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "ja3_fingerprints" }, { "type": "logs", "dataset": "ti_abusech.malware", "ilm_policy": "logs-ti_abusech.malware-default_policy", "title": "Malware payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch URLhaus API to collect malware payloads.", "multi": false, "required": true, "show_user": false, "default": "https://urlhaus-api.abuse.ch/v1/payloads/recent/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the URLhaus API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malware" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malware payloads", "description": "Collect malware payloads from abuse.ch URLhaus.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malware" }, { "type": "logs", "dataset": "ti_abusech.malwarebazaar", "ilm_policy": "logs-ti_abusech.malwarebazaar-default_policy", "title": "MalwareBazaar payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch MalwareBazaar API to collect malware payloads.", "multi": false, "required": true, "show_user": false, "default": "https://mb-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the MalwareBazaar API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malwarebazaar" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "MalwareBazaar payloads", "description": "Collect malware payloads from abuse.ch MalwareBazaar.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malwarebazaar" }, { "type": "logs", "dataset": "ti_abusech.sslblacklist", "ilm_policy": "logs-ti_abusech.sslblacklist-default_policy", "title": "SSL Blacklisted Certificates", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch SSLBL API to collect malicious SSL blacklisted certificates identified by SSLBL.", "multi": false, "required": true, "show_user": false, "default": "https://sslbl.abuse.ch/blacklist/sslblacklist.csv" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the SSLBL API. Supported units for this parameter are h/m/s. Example `24h`. As data dump is generated every 5 minutes, it should be greater than 5 minutes.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-sslblacklist" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "SSL Blacklisted Certificates", "description": "Collect malicious SSL blacklisted certificates from abuse.ch SSLBL.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "sslblacklist" }, { "type": "logs", "dataset": "ti_abusech.threatfox", "ilm_policy": "logs-ti_abusech.threatfox-default_policy", "title": "ThreatFox threat indicators", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch ThreatFox API to collect threat indicators.", "multi": false, "required": true, "show_user": false, "default": "https://threatfox-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the ThreatFox API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "integer", "title": "Initial Interval", "description": "How far back to pull the threat indicators from ThreatFox in days. Can be any number between `1` to `7`. Example `5`. Default value is `7` i.e., 7 days.", "multi": false, "required": true, "show_user": true, "default": 7 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-threatfox" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "ThreatFox threat indicators", "description": "Collect threat indicators from abuse.ch ThreatFox.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "threatfox" }, { "type": "logs", "dataset": "ti_abusech.url", "ilm_policy": "logs-ti_abusech.url-default_policy", "title": "Malware URLs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch URLhaus API to collect recently added malware URLs.", "multi": false, "required": true, "show_user": false, "default": "https://urlhaus-api.abuse.ch/v1/urls/recent/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the URLhaus API. The API returns at most 1000 URLs added in the last 3 days, so the interval must be short enough to avoid exceeding that limit. Too long an interval risks missing URLs; too short an interval re-collects the same URLs without benefit. Supported units: h/m/s. Example `10m`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since it was first seen. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-url" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malware URLs", "description": "Collect malware URLs from abuse.ch URLhaus.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "url" } ] }