{ "name": "ti_threatconnect", "title": "ThreatConnect", "version": "2.3.1", "release": "ga", "description": "Collects Indicators from ThreatConnect using the Elastic Agent and saves them as logs inside Elastic", "type": "integration", "download": "/epr/ti_threatconnect/ti_threatconnect-2.3.1.zip", "path": "/package/ti_threatconnect/2.3.1", "icons": [ { "src": "/img/threat-connect-logo.svg", "path": "/package/ti_threatconnect/2.3.1/img/threat-connect-logo.svg", "title": "Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.2 || ^9.1.2" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_threatconnect/ti_threatconnect-2.3.1.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_threatconnect/2.3.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/threat-connect-indicator-dashboard.png", "path": "/package/ti_threatconnect/2.3.1/img/threat-connect-indicator-dashboard.png", "title": "Sample screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ti_threatconnect/2.3.1/LICENSE.txt", "/package/ti_threatconnect/2.3.1/changelog.yml", "/package/ti_threatconnect/2.3.1/manifest.yml", "/package/ti_threatconnect/2.3.1/validation.yml", "/package/ti_threatconnect/2.3.1/docs/README.md", "/package/ti_threatconnect/2.3.1/img/threat-connect-indicator-dashboard.png", "/package/ti_threatconnect/2.3.1/img/threat-connect-logo.svg", "/package/ti_threatconnect/2.3.1/data_stream/indicator/lifecycle.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/manifest.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/sample_event.json", "/package/ti_threatconnect/2.3.1/elasticsearch/ingest_pipeline/tactics_compatibility.yml", "/package/ti_threatconnect/2.3.1/kibana/dashboard/ti_threatconnect-2d465f90-973d-11ee-839e-ef65b7014120.json", "/package/ti_threatconnect/2.3.1/data_stream/indicator/fields/base-fields.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/fields/beats.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/fields/ecs.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/fields/fields.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/fields/is-ioc-transform-source-true.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/manifest.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/transform.yml", "/package/ti_threatconnect/2.3.1/data_stream/indicator/agent/stream/cel.yml.hbs", "/package/ti_threatconnect/2.3.1/data_stream/indicator/elasticsearch/ilm/default_policy.json", "/package/ti_threatconnect/2.3.1/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/agent.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/base-fields.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/beats.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/ecs.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/fields.yml", "/package/ti_threatconnect/2.3.1/elasticsearch/transform/latest/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "threatconnect", "title": "ThreatConnect Indicators", "description": "Collect ThreatConnect indicators.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the ThreatConnect API. Default URL given is for ThreatConnect's Public Cloud instance. Note: Do not include trailing slash “/” character.", "multi": false, "required": true, "show_user": true, "default": "https://app.threatconnect.com" }, { "name": "access_id", "type": "text", "title": "Access ID", "description": "Access ID of a ThreatConnect API User.", "multi": false, "required": true, "show_user": true }, { "name": "secret_key", "type": "password", "title": "Secret Key", "description": "Secret Key of a ThreatConnect API User.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false } ], "title": "Collect ThreatConnect indicators via API", "description": "Collecting ThreatConnect indicators via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_threatconnect.indicator", "ilm_policy": "logs-ti_threatconnect.indicator-default_policy", "title": "Collect Indicators from ThreatConnect.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "tql", "type": "text", "title": "TQL", "description": "Filter results based on query written in [TQL](https://knowledge.threatconnect.com/docs/constructing-query-expressions).", "multi": false, "required": false, "show_user": true }, { "name": "include_attributes", "type": "bool", "title": "Include Attributes in the response", "description": "Elastic has a default async search response size of 10MB. Enabling this option may result in larger response size, which may cause problems when using the Kibana discover view.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "include_group_assoc", "type": "bool", "title": "Include Group Associations in the response", "description": "Elastic has a default async search response size of 10MB. Enabling this option may result in larger response size, which may cause problems when using the Kibana discover view.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "include_group_assoc_attribs", "type": "bool", "title": "Include Group Associations with their Attributes in the response", "description": "This requires the API user account to have the option \"Allow User to Exceed API Link Limit\" enabled. Elastic has a default async search response size of 10MB. Enabling this option may result in larger response size, which may cause problems when using the Kibana discover view.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "include_indicator_assoc", "type": "bool", "title": "Include Indicator Associations in the response", "description": "Elastic has a default async search response size of 10MB. Enabling this option may result in larger response size, which may cause problems when using the Kibana discover view.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull Indicators and the groups associated with those indicators from ThreatConnect. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "168h" }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Enforces all IOCs to expire after this duration. This setting is required to avoid \"orphaned\" IOCs that never expire. Specify [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) using only days, hours, or minutes (e.g., 10d), avoiding mixed time units.", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the ThreatConnect API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the ThreatConnect API. The maximum supported batch size value is 10000.", "multi": false, "required": true, "show_user": false, "default": 2000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "2m" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "threatconnect-indicator" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Indicators", "description": "Collect Indicators from ThreatConnect.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_threatconnect", "path": "indicator" } ] }