11
2- @node Threat indicators using STIX
3- @section Threat indicators using STIX
4- @cindex STIX
5- @cindex TAXII
6- @cindex STIX indicators
7- @cindex Threat indicators
8- @cindex Cyber threat indicators
2+ @node Threat indicators
3+ @section Threat indicators
4+ @cindex IOC
5+ @cindex Indicator of Compromise
6+ @cindex Indicator
7+ @cindex Threat indicator
98@cindex JSON
109
11- We've been experimenting with an open model for describing cyber
12- threats. STIX is a community-driven effort to standardise a model for cyber
13- theat information. TAXII defines a set of services for distributing STIX
14- information. There's some support in @command {Cyberprobe }, but you should
15- know that this is very prototype at the moment.
10+ Cyberprobe includes a subscriber which apply indicators to events. When
11+ an event matches an indicator, information about the indicator is tagged
12+ into the event.
1613
17- This is what we've got so far:
14+ Indicator support is present in the @command {cybermon-detector } subscriber
15+ which reads indicators from a JSON file.
1816
19- @itemize
17+ @heading Indicator files
2018
21- @item
22- There's a simple CSV file format we've created to describe cyber
23- threats. This is just for convenience .
19+ The installation bundle includes a a file containing some
20+ sample indicators, search for @ file{ indicators.json }, which may be installed
21+ at @file { @value { PREFIX } /share/doc/cyberprobe } .
2422
25- @cindex @command {stix-create }
26- @item
27- A script, @command {stix-create } which reads the above configuration file,
28- and converts into a STIX document containing Indicator objects.
2923
30- @cindex @command {taxii-server }
31- @item
32- A script, @command {taxii-server } which acts as a very simple TAXII server,
33- serving up STIX documents.
3424
35- @cindex @command {taxii-client }
36- @item
37- A script, @command {taxii-client } which connects to a TAXII server, gets STIX
38- documents and dumps some stuff out.
3925
40- @cindex @command {taxii-sync-json }
41- @item
42- A script @command {taxii-sync-json } which connects to a TAXII server, gets
43- STIX documents, massages the whole lot into a single JSON form, and dumps
44- that to a file. This is intended to be used with the
45- @file {cybermon-detector } subscriber.
46- See @ref {@command {cybermon-detector } invocation }.
4726
48- @item
49- A configuration file for @command {cybermon } which reads the JSON threat
50- information and reports when theats are observed.
5127
52- @end itemize
53-
54- @cindex @code {pyOpenSSL }
55- @cindex @code {libtaxii }
56- @cindex @code {stix }
57- @cindex @code {pip }
58-
59- Before taking this any further, you need to have Python installed, along
60- with various dependencies (@code {pyOpenSSL }, @code {libtaxii } and
61- @code {stix }). The easiest way to install the dependencies is to install
62- @code {pip }, and issue this command:
63-
64- @example
65- sudo pip install libtaxii pyOpenSSL stix
66- @end example
67-
68- @heading A STIX document service
69-
70- The installation bundle includes a couple of CSV files containing some
71- fictional cyber theats. Search for @file {example1.txt } and
72- @file {example2.txt }. They may be in @file {@value {PREFIX }/share/doc/cyberprobe }
73- once you've installed everything. You need to create a data area, and
74- convert these files into STIX ready for serving:
75-
76- @example
77- mkdir /tmp/stix
78- cd /tmp/stix
79- mkdir -p data/default
80- stix-create @value {PREFIX }/share/doc/cyberprobe/example1.txt \
81- data/default/1 -i ex:1
82- stix-create @value {PREFIX }/share/doc/cyberprobe/example2.txt \
83- data/default/2 -i ex:2
84- @end example
85-
86- Check that you have two new XML files in data/default directory. If they're
87- there, you're ready to start a STIX server. This will run on port 8080, so
88- you'll need to use a different port number if you don't like this one. It's
89- important that this is run from the directory where you just created the
90- data directory.
91-
92- @example
93- taxii-server -- port 8080
94- @end example
95-
96- If that works, use the test client to communicate:
97-
98- @example
99- taxii-client -- port 8080 -- poll
100- @end example
101-
102- And you should see some stuff that looks like cyber threat information
103- dumped on the screen.
10428
10529@heading Deploying theat information to @command {cybermon }
10630
107- @cindex JSON
108-
109- Now, we use @command {taxii-sync-json } to fetch the STIX information in a
110- JSON form I can easily ingest into the LUA code:
111-
112- @example
113- taxii-sync-json -- port 8080
114- @end example
115-
116- This will create a JSON file called @file {stix-default-combined.json }.
117-
118- Finally, run processing. Stop any running @command {cybermon } and
119- @command {cybermon-elasticsearch } processes. Then run @command {cybermon }
120- to publish to a queue on RabbitMQ:
31+ To run using your existing processing pipeline, stop any running
32+ @command {cybermon } and @command {cybermon-elasticsearch } processes. Then run
33+ @command {cybermon } to publish to a queue on RabbitMQ:
12134
12235@example
12336cybermon -p 10000 -c @value {SYSCONFDIR }/cyberprobe/amqp-topic.lua
12437@end example
12538
126- Next run @command {cyberprobe-detector } to apply STIX rules. By default,
39+ Next run @command {cyberprobe-detector } to apply indicator rules. By default,
12740this will subscribe to @samp {cyberprobe } and publish to @samp {ioc }:
12841
12942@example
130- STIX_INDICATORS=stix-default-combined .json cybermon-detector \
43+ env INDICATORS=/path/to/indicators .json cybermon-detector \
13144 cyberprobe ioc
13245@end example
13346
@@ -148,33 +61,32 @@ cybermon-dump ioc | jq --unbuffered .indicators
14861This activity should trigger a theat:
14962
15063@example
151- wget -q -O- http://www.malware.com /malware.dat
64+ wget -q -O- http://www.malware.org /malware.dat
15265@end example
15366
15467If this works, you should see the following output:
15568
15669@example
15770[
15871 @{
72+ "description": "URL of a page serving malware",
73+ "category": "malware",
74+ "author": "someone@@ example.com",
75+ "source": "id:3245edd9-e0f3-4982-9406-fbf93b874555",
15976 "type": "url",
160- "id": "example1:7",
161- "value": "http://www.malware.com/malware.dat",
162- "description": "URL of a page serving malware"
77+ "value": "http://malware.org/malware.dat"
16378 @}
16479]
16580@end example
16681
16782This hits on a number of theat indicators. The hostname www.malware.com is
16883present in a theat indicator, and it is detected in the HTTP request, and
16984both the DNS query and response. Also, the URL
170- @code {http://www.malware.com /malware.dat } is in a threat indicator and it is
85+ @code {http://www.malware.org /malware.dat } is in a threat indicator and it is
17186detected in both the HTTP request and response.
17287
17388@command {cybermon-detector } updates its state if
174- the JSON configuration file has changed. So, you can do a round-trip update
175- by changing the input files, re-running stix-create, using
176- @command {taxii-sync-json } to fetch the updates, and all without stopping the
177- monitoring.
89+ the JSON configuration file has changed.
17890
17991If you want to load the output of @command {cybermon-detector } into
18092ElasticSearch, you can, but you need to subscribe to @samp {ioc }:
@@ -183,6 +95,12 @@ ElasticSearch, you can, but you need to subscribe to @samp{ioc}:
18395cybermon-elasticsearch ioc
18496@end example
18597
98+ This results in indicator hit information being loaded into ES.
99+
100+ For more information on indicators, see
101+ @ref {@command {cybermon-detector } invocation } and
102+ @ref {Cyberprobe indicator format }.
103+
186104@heading Conclusion
187105
188106All done, I hope you enjoyed the tutorial! Any comments on the software, or
0 commit comments