{ "name": "ti_socradar_taxii", "title": "SOCRadar Threat Intelligence (TAXII)", "version": "0.2.0", "release": "beta", "description": "Ingest threat intelligence indicators from SOCRadar's TAXII 2.1 server in STIX 2.1 format with Elastic Agent.", "type": "integration", "download": "/epr/ti_socradar_taxii/ti_socradar_taxii-0.2.0.zip", "path": "/package/ti_socradar_taxii/0.2.0", "icons": [ { "src": "/img/logo.svg", "path": "/package/ti_socradar_taxii/0.2.0/img/logo.svg", "title": "SOCRadar TAXII", "size": "216x216", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_socradar_taxii/ti_socradar_taxii-0.2.0.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_socradar_taxii/0.2.0/docs/README.md", "license": "basic", "assets": [ "/package/ti_socradar_taxii/0.2.0/LICENSE.txt", "/package/ti_socradar_taxii/0.2.0/changelog.yml", "/package/ti_socradar_taxii/0.2.0/manifest.yml", "/package/ti_socradar_taxii/0.2.0/docs/README.md", "/package/ti_socradar_taxii/0.2.0/img/logo.svg", "/package/ti_socradar_taxii/0.2.0/kibana/tags.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/lifecycle.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/manifest.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/sample_event.json", "/package/ti_socradar_taxii/0.2.0/kibana/dashboard/ti_socradar_taxii-overview.json", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/fields/agent.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/fields/base-fields.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/fields/beats.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/fields/fields.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/fields/is-ioc-transform-source-true.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/transform.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/agent/stream/cel.yml.hbs", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ilm/default_policy.json", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-asn.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-domain-name.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-email.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-file.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-ip.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-url.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-windows-registry.yml", "/package/ti_socradar_taxii/0.2.0/data_stream/indicator/elasticsearch/ingest_pipeline/indicator-x509.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/fields/agent.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/fields/base-fields.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/fields/beats.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/fields/fields.yml", "/package/ti_socradar_taxii/0.2.0/elasticsearch/transform/latest_ioc/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "ti_socradar_taxii", "title": "SOCRadar TAXII", "description": "Collect threat intelligence indicators from SOCRadar's TAXII 2.1 server.", "inputs": [ { "type": "cel", "vars": [ { "name": "base_url", "type": "text", "title": "SOCRadar TAXII Base URL", "description": "Base URL of the SOCRadar TAXII 2.1 server. Default `https://taxii2.socradar.com`. Change only if SOCRadar provides a different host.\n", "multi": false, "required": true, "show_user": true, "default": "https://taxii2.socradar.com" }, { "name": "collections_config", "type": "yaml", "title": "Collections Configuration", "description": "YAML array of TAXII collections to poll. Each entry needs `api_root` and `collection_id`. SOCRadar API roots: `radar_alpha` (~15 collections), `radar_gamma` (~150 collections), `radar_premium` (~600 collections). The agent polls one collection per `Interval` tick in round-robin fashion. If a collection_id or api_root is invalid, that tick is skipped (no system stall) and polling continues with the next collection on the next tick. To find collection IDs use the SOCRadar Platform UI under Threat Intelligence → TAXII Collections, then append entries below.\n", "multi": false, "required": true, "show_user": true, "default": "- api_root: \"radar_alpha\"\n collection_id: \"fd3fec42-efee-4353-85b2-cb87f9acc4ef\"\n" }, { "name": "username", "type": "text", "title": "Username", "description": "The username for Basic HTTP authentication to the SOCRadar TAXII server.", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "The password for Basic HTTP authentication to the SOCRadar TAXII server.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# ...\n# -----END CERTIFICATE-----\n" } ], "title": "Collect SOCRadar STIX data via TAXII 2.1", "description": "Collect STIX 2.1 threat intelligence indicators from SOCRadar's TAXII 2.1 server." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "beta" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_socradar_taxii.indicator", "ilm_policy": "logs-ti_socradar_taxii.indicator-default_policy", "title": "STIX 2.1 indicators from SOCRadar TAXII", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the SOCRadar TAXII server. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to look for indicators the first time the agent is started. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "10h" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Indicator is expired after this duration since its last seen timestamp. Use [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) in days, hours, or minutes (e.g 10d). Default `90d`.\n", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "limit", "type": "integer", "title": "Limit", "description": "The maximum number of STIX objects to return per TAXII request. It must be a positive number.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "ti_socradar_taxii-indicator" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collects STIX 2.1 indicators from SOCRadar TAXII 2.1 server", "description": "Collects threat intelligence indicators in STIX 2.1 format from SOCRadar's TAXII 2.1 server via CEL input.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_socradar_taxii", "path": "indicator" } ] }