{ "name": "ti_abusech", "title": "abuse.ch", "version": "5.1.0", "release": "ga", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.", "type": "integration", "download": "/epr/ti_abusech/ti_abusech-5.1.0.zip", "path": "/package/ti_abusech/5.1.0", "icons": [ { "src": "/img/abusech2.svg", "path": "/package/ti_abusech/5.1.0/img/abusech2.svg", "title": "abuse.ch", "size": "512x512", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.1.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_abusech/ti_abusech-5.1.0.zip.sig", "format_version": "3.4.2", "readme": "/package/ti_abusech/5.1.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/abusech-overview.png", "path": "/package/ti_abusech/5.1.0/img/abusech-overview.png", "title": "abuse.ch Overview Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-files.png", "path": "/package/ti_abusech/5.1.0/img/abusech-files.png", "title": "abuse.ch Files Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-urls.png", "path": "/package/ti_abusech/5.1.0/img/abusech-urls.png", "title": "abuse.ch URLs Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-rules.png", "path": "/package/ti_abusech/5.1.0/img/abusech-rules.png", "title": "abuse.ch Rules Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-softwares.png", "path": "/package/ti_abusech/5.1.0/img/abusech-softwares.png", "title": "abuse.ch Softwares and x509 Certificates Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/abusech-domains.png", "path": "/package/ti_abusech/5.1.0/img/abusech-domains.png", "title": "abuse.ch Domains and IP Addresses Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ti_abusech/5.1.0/LICENSE.txt", "/package/ti_abusech/5.1.0/changelog.yml", "/package/ti_abusech/5.1.0/manifest.yml", "/package/ti_abusech/5.1.0/validation.yml", "/package/ti_abusech/5.1.0/docs/README.md", "/package/ti_abusech/5.1.0/img/abusech-domains.png", "/package/ti_abusech/5.1.0/img/abusech-files.png", "/package/ti_abusech/5.1.0/img/abusech-overview.png", "/package/ti_abusech/5.1.0/img/abusech-rules.png", "/package/ti_abusech/5.1.0/img/abusech-softwares.png", "/package/ti_abusech/5.1.0/img/abusech-urls.png", "/package/ti_abusech/5.1.0/img/abusech2.svg", "/package/ti_abusech/5.1.0/kibana/tags.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/malware/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/malware/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/malware/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/threatfox/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/url/lifecycle.yml", "/package/ti_abusech/5.1.0/data_stream/url/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/url/sample_event.json", "/package/ti_abusech/5.1.0/data_stream/yaraify/manifest.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/sample_event.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-18caef63-b36a-4e7b-95c7-3c0b1e882425.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-68ac01ad-dddf-476c-9a54-8c33c1047e53.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json", "/package/ti_abusech/5.1.0/kibana/dashboard/ti_abusech-d11a94be-9b9f-42f8-9fed-d5e89005f24d.json", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/malware/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/agent.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/ecs.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/url/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/fields/base-fields.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/fields/beats.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/fields/fields.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/fields/is-ioc-transform-source-true.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/transform.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/manifest.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/transform.yml", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/ja3_fingerprints/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/malware/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/malware/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/malware/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/sslblacklist/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/threatfox/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/threatfox/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/url/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/url/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/url/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/data_stream/yaraify/agent/stream/cel.yml.hbs", "/package/ti_abusech/5.1.0/data_stream/yaraify/elasticsearch/ilm/default_policy.json", "/package/ti_abusech/5.1.0/data_stream/yaraify/elasticsearch/ingest_pipeline/default.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_ja3_fingerprints/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malware/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_malwarebazaar/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_sslblacklist/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_threatfox/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_url/fields/is-ioc-transform-source-false.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/agent.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/base-fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/beats.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/ecs.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/fields.yml", "/package/ti_abusech/5.1.0/elasticsearch/transform/latest_yaraify/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "ti_abusech", "title": "abuse.ch API", "description": "Ingest threat intelligence indicators from URL Haus, Malware Bazaar, Threat Fox, and YARAify feeds with Elastic Agent.", "inputs": [ { "type": "cel", "vars": [ { "name": "api_type", "type": "select", "title": "API Type", "description": "Select the abuse.ch API to use for the ThreatFox, MalwareBazaar, Malware URLs, and YARAify datasets. Community API uses an Auth Key. Commercial API uses Spamhaus credentials and JWT authentication. The Malware payloads dataset always uses the Community API and requires an Auth Key regardless of this setting.", "multi": false, "required": false, "show_user": true, "default": "community" }, { "name": "username", "type": "text", "title": "Username (Commercial)", "description": "Email address for the abuse.ch Commercial API account from the [Spamhaus Customer Portal](https://portal.spamhaus.com). Required when API Type is Commercial API.", "multi": false, "required": false, "show_user": true }, { "name": "password", "type": "password", "title": "Password (Commercial)", "description": "Password for the abuse.ch Commercial API account. Required when API Type is Commercial API.", "multi": false, "required": false, "show_user": true }, { "name": "auth_key", "type": "password", "title": "Auth Key (Community)", "description": "abuse.ch Auth Key for the Community API. Required when API Type is Community API. See [documentation](https://abuse.ch/blog/community-first/) for details.", "multi": false, "required": false, "show_user": true }, { "name": "commercial_url", "type": "text", "title": "Commercial API URL", "description": "Base URL for the abuse.ch Commercial API (Spamhaus).", "multi": false, "required": false, "show_user": false, "default": "https://api.spamhaus.com" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "title": "Collect abuse.ch logs via API", "description": "Collect abuse.ch logs via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "beta" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_abusech.ja3_fingerprints", "ilm_policy": "logs-ti_abusech.ja3_fingerprints-default_policy", "title": "JA3 Fingerprints", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch SSLBL API to collect active malicious JA3 fingerprints identified by SSLBL.", "multi": false, "required": true, "show_user": false, "default": "https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the SSLBL API. Supported units for this parameter are h/m/s. Example `24h`. As data dump is generated every 5 minutes, it should be greater than 5 minutes.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-ja3_fingerprints" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "JA3 Fingerprints", "description": "Collect malicious JA3 fingerprints from abuse.ch SSLBL.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "ja3_fingerprints" }, { "type": "logs", "dataset": "ti_abusech.malware", "ilm_policy": "logs-ti_abusech.malware-default_policy", "title": "Malware payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch URLhaus API to collect malware payloads.", "multi": false, "required": true, "show_user": false, "default": "https://urlhaus-api.abuse.ch/v1/payloads/recent/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the URLhaus API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malware" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malware payloads", "description": "Collect malware payloads from abuse.ch URLhaus.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malware" }, { "type": "logs", "dataset": "ti_abusech.malwarebazaar", "ilm_policy": "logs-ti_abusech.malwarebazaar-default_policy", "title": "MalwareBazaar payloads", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL of the MalwareBazaar Community API.", "multi": false, "required": true, "show_user": false, "default": "https://mb-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the MalwareBazaar API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull malware samples from MalwareBazaar when using the Commercial API. Supported units for this parameter are h/m/s. Example `120h`. Default value is `24h`.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Number of malware samples to request per page when using the Commercial API.", "multi": false, "required": false, "show_user": false, "default": 100 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-malwarebazaar" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "MalwareBazaar payloads", "description": "Collect malware payloads from abuse.ch MalwareBazaar.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "malwarebazaar" }, { "type": "logs", "dataset": "ti_abusech.sslblacklist", "ilm_policy": "logs-ti_abusech.sslblacklist-default_policy", "title": "SSL Blacklisted Certificates", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the abuse.ch SSLBL API to collect malicious SSL blacklisted certificates identified by SSLBL.", "multi": false, "required": true, "show_user": false, "default": "https://sslbl.abuse.ch/blacklist/sslblacklist.csv" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the SSLBL API. Supported units for this parameter are h/m/s. Example `24h`. As data dump is generated every 5 minutes, it should be greater than 5 minutes.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-sslblacklist" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "SSL Blacklisted Certificates", "description": "Collect malicious SSL blacklisted certificates from abuse.ch SSLBL.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "sslblacklist" }, { "type": "logs", "dataset": "ti_abusech.threatfox", "ilm_policy": "logs-ti_abusech.threatfox-default_policy", "title": "ThreatFox threat indicators", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL of the ThreatFox Community API.", "multi": false, "required": true, "show_user": false, "default": "https://threatfox-api.abuse.ch/api/v1/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the ThreatFox API. Supported units for this parameter are h/m/s. Example `24h`.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "integer", "title": "Initial Interval", "description": "How far back to pull the threat indicators from ThreatFox in days. Can be any number between `1` to `7`. Example `5`. Default value is `7` i.e., 7 days.", "multi": false, "required": true, "show_user": true, "default": 7 }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Number of IOCs to request per page when using the Commercial API.", "multi": false, "required": false, "show_user": false, "default": 100 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-threatfox" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "ThreatFox threat indicators", "description": "Collect threat indicators from abuse.ch ThreatFox.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "threatfox" }, { "type": "logs", "dataset": "ti_abusech.url", "ilm_policy": "logs-ti_abusech.url-default_policy", "title": "Malware URLs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL of the URLhaus Community API.", "multi": false, "required": true, "show_user": true, "default": "https://urlhaus-api.abuse.ch/v1/urls/recent/" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the URLhaus API. For the Community API, the endpoint returns at most 1000 URLs added in the last 3 days, so the interval must be short enough to avoid exceeding that limit. Too long an interval risks missing URLs; too short an interval re-collects the same URLs without benefit. Supported units: h/m/s. Example `10m`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull malware URLs from URLhaus when using the Commercial API. Supported units for this parameter are h/m/s. Example `120h`. Default value is `24h`.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Number of malware URLs to request per page when using the Commercial API.", "multi": false, "required": false, "show_user": false, "default": 100 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since it was first seen. Supported units for this parameter are d/h/m. Example `10d`. Default value is `90d` i.e., 90 days.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-url" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malware URLs", "description": "Collect malware URLs from abuse.ch URLhaus.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_abusech", "path": "url" }, { "type": "logs", "dataset": "ti_abusech.yaraify", "ilm_policy": "logs-ti_abusech.yaraify-default_policy", "title": "YARAify Rules", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL of the YARAify Community API.", "multi": false, "required": true, "show_user": true, "default": "https://yaraify-api.abuse.ch/api/v1/" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the YARAify API. Supported units are h/m/s. Example `10m`.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull YARA rule metadata on the first run when using the Commercial API. Supported units are h/m/s. Example `120h`. Default value is `24h`.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Number of YARA rules to request per page when using the Commercial API (1–100).", "multi": false, "required": false, "show_user": false, "default": 100 }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since it was first seen. Supported units are d/h/m. Example `10d`. Default value is `90d`.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "abusech-yaraify" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "YARAify Rules", "description": "Collect YARA rule metadata from the abuse.ch YARAify Community or Commercial API.", "enabled": false, "ingestion_method": "API" } ], "package": "ti_abusech", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "yaraify" } ] }