Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alienvault, CrowdStrike, Phishunt, ThreatFox, URLHaus] added the ability to set x_opencti_score for select connectors #2554

Merged
merged 7 commits into from
Sep 27, 2024

Conversation

brett-fitz
Copy link
Contributor

@brett-fitz brett-fitz commented Aug 28, 2024

Proposed changes

  • Alienvault: Allow the ability to set the default x_opencti_score or set it by main_observable_type
  • CrowdStrike: Allow the ability to set the x_opencti_score based on the low, medium and high score labels added by CrowdStrike.
  • Phishunt: Allow the ability to set the default x_opencti_score or set it by observable type.
  • ThreatFox: Allow the ability to set the default x_opencti_score or set it by observable type.
  • URLHaus: Allow the ability to set the default x_opencti_score.

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

#2725

@brett-fitz
Copy link
Contributor Author

Tested CrowdStrike with configurations:

      CROWDSTRIKE_INDICATOR_LOW_SCORE: "40"
      CROWDSTRIKE_INDICATOR_LOW_SCORE_LABELS: "MaliciousConfidence/Low"
      CROWDSTRIKE_INDICATOR_MEDIUM_SCORE: "60"
      CROWDSTRIKE_INDICATOR_MEDIUM_SCORE_LABELS: "MaliciousConfidence/Medium"
      CROWDSTRIKE_INDICATOR_HIGH_SCORE: "80"
      CROWDSTRIKE_INDICATOR_HIGH_SCORE_LABELS: "MaliciousConfidence/High"

and no environment variables set. Both worked as intended 🎉

@brett-fitz
Copy link
Contributor Author

Tested alienvault with configuration:

      - ALIENVAULT_DEFAULT_X_OPENCTI_SCORE=50
      - ALIENVAULT_X_OPENCTI_SCORE_IP=60
      - ALIENVAULT_X_OPENCTI_SCORE_DOMAIN=70
      - ALIENVAULT_X_OPENCTI_SCORE_HOSTNAME=75
      - ALIENVAULT_X_OPENCTI_SCORE_EMAIL=70
      - ALIENVAULT_X_OPENCTI_SCORE_FILE=85
      - ALIENVAULT_X_OPENCTI_SCORE_URL=80
      - ALIENVAULT_X_OPENCTI_SCORE_MUTEX=60
      - ALIENVAULT_X_OPENCTI_SCORE_CRYPTOCURRENCY_WALLET=80

and no environment variables set. Both worked as intended 🎉

@brett-fitz
Copy link
Contributor Author

Tested ThreatFox with configuration:

THREATFOX_DEFAULT_X_OPENCTI_SCORE: "50"
THREATFOX_X_OPENCTI_SCORE_IP: "60"
THREATFOX_X_OPENCTI_SCORE_DOMAIN: "70"
THREATFOX_X_OPENCTI_SCORE_URL: "75"
THREATFOX_X_OPENCTI_SCORE_HASH: "80"

and no environment variables set. Both worked as intended 🎉

@brett-fitz brett-fitz marked this pull request as ready for review September 9, 2024 17:13
@Jipegien Jipegien added the community use to identify PR from community label Sep 10, 2024
@brett-fitz brett-fitz changed the title added the ability to set x_opencti_score for select connectors [Alienvault, CrowdStrike, Phishunt, ThreatFox, URLHaus] added the ability to set x_opencti_score for select connectors Sep 11, 2024
@Powlinett Powlinett added the do not merge Do not merge this PR until this tag will be removed label Sep 26, 2024
Copy link
Member

@Powlinett Powlinett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Manual tests ok for: AlienVault, Crowdstrike, ThreatFox and URLHaus 👍
Not able to test Phishunt as the API doesn't send back any data for now but the code seems right.

@Powlinett Powlinett merged commit 71c398a into OpenCTI-Platform:master Sep 27, 2024
3 checks passed
@Powlinett Powlinett removed the do not merge Do not merge this PR until this tag will be removed label Sep 27, 2024
@brett-fitz brett-fitz deleted the connector-score-update branch September 27, 2024 15:12
uTomasAnderson pushed a commit to uTomasAnderson/connectors that referenced this pull request Oct 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
community use to identify PR from community
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants