Skip to content

Commit 3838fde

Browse files
v-dvedakv-dvedak
authored
Merge pull request Azure#12903 from VirusTotal/feat/update-upload-indicators
Google Threat Intelligence: Using UploadSTIXObjects action
2 parents 52c5491 + 236adc0 commit 3838fde

File tree

6 files changed

+25
-33
lines changed

6 files changed

+25
-33
lines changed

‎Solutions/Google Threat Intelligence/Package/3.2.2.zip‎

-3 Bytes
Binary file not shown.

‎Solutions/Google Threat Intelligence/Package/mainTemplate.json‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1569,15 +1569,11 @@
15691569
"schema": {
15701570
"type": "object",
15711571
"properties": {
1572-
"type": {
1573-
"type": "string",
1574-
"description": "type"
1575-
},
1576-
"id": {
1572+
"sourcesystem": {
15771573
"type": "string",
1578-
"description": "id"
1574+
"description": "sourcesystem"
15791575
},
1580-
"objects": {
1576+
"stixobjects": {
15811577
"type": "array",
15821578
"items": {
15831579
"type": "object",
@@ -3881,9 +3877,9 @@
38813877
},
38823878
"For_each": {
38833879
"type": "Foreach",
3884-
"foreach": "@chunk(body('get_threat_list')?['indicators'],100)",
3880+
"foreach": "@chunk(coalesce(body('get_threat_list')?['indicators'],body('get_threat_list')?['stixobjects']),100)",
38853881
"actions": {
3886-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": {
3882+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": {
38873883
"type": "ApiConnection",
38883884
"inputs": {
38893885
"host": {
@@ -3894,9 +3890,9 @@
38943890
"method": "post",
38953891
"body": {
38963892
"sourcesystem": "Google Threat Intelligence",
3897-
"indicators": "@items('For_each')"
3893+
"stixobjects": "@items('For_each')"
38983894
},
3899-
"path": "/V2/ThreatIntelligence/@{encodeURIComponent('')}/UploadIndicators/"
3895+
"path": "/ThreatIntelligence/@{encodeURIComponent('')}/UploadStixObjects/"
39003896
}
39013897
}
39023898
},
@@ -4131,7 +4127,7 @@
41314127
}
41324128
}
41334129
},
4134-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": {
4130+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": {
41354131
"type": "ApiConnection",
41364132
"inputs": {
41374133
"host": {
@@ -4142,9 +4138,9 @@
41424138
"method": "post",
41434139
"body": {
41444140
"sourcesystem": "Google Threat Intelligence",
4145-
"indicators": "@body('Get_IoC_Stream_list')?['objects']"
4141+
"stixobjects": "@coalesce(body('Get_IoC_Stream_list')?['objects'], body('Get_IoC_Stream_list')?['stixobjects'])"
41464142
},
4147-
"path": "/V2/ThreatIntelligence/@{encodeURIComponent('')}/UploadIndicators/"
4143+
"path": "/ThreatIntelligence/@{encodeURIComponent('')}/UploadStixObjects/"
41484144
},
41494145
"runAfter": {
41504146
"Get_IoC_Stream_list": [
@@ -4159,7 +4155,7 @@
41594155
"value": "@body('Get_IoC_Stream_list')?['extensions']?['extension-definition--e0e2bd88-8e87-52d5-b822-3fdd60918598']?['meta']?['cursor']"
41604156
},
41614157
"runAfter": {
4162-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": [
4158+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": [
41634159
"Succeeded"
41644160
]
41654161
}

‎Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTICustomConnector/azuredeploy.json‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1411,15 +1411,11 @@
14111411
"schema": {
14121412
"type": "object",
14131413
"properties": {
1414-
"type": {
1415-
"type": "string",
1416-
"description": "type"
1417-
},
1418-
"id": {
1414+
"sourcesystem": {
14191415
"type": "string",
1420-
"description": "id"
1416+
"description": "sourcesystem"
14211417
},
1422-
"objects": {
1418+
"stixobjects": {
14231419
"type": "array",
14241420
"items": {
14251421
"type": "object",

‎Solutions/Google Threat Intelligence/Playbooks/GTIIocStream/azuredeploy.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@
104104
}
105105
}
106106
},
107-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": {
107+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": {
108108
"type": "ApiConnection",
109109
"inputs": {
110110
"host": {
@@ -115,9 +115,9 @@
115115
"method": "post",
116116
"body": {
117117
"sourcesystem": "Google Threat Intelligence",
118-
"indicators": "@body('Get_IoC_Stream_list')?['objects']"
118+
"stixobjects": "@coalesce(body('Get_IoC_Stream_list')?['objects'], body('Get_IoC_Stream_list')?['stixobjects'])"
119119
},
120-
"path": "/V2/ThreatIntelligence/@{encodeURIComponent('')}/UploadIndicators/"
120+
"path": "/ThreatIntelligence/@{encodeURIComponent('')}/UploadStixObjects/"
121121
},
122122
"runAfter": {
123123
"Get_IoC_Stream_list": [
@@ -132,7 +132,7 @@
132132
"value": "@body('Get_IoC_Stream_list')?['extensions']?['extension-definition--e0e2bd88-8e87-52d5-b822-3fdd60918598']?['meta']?['cursor']"
133133
},
134134
"runAfter": {
135-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": [
135+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": [
136136
"Succeeded"
137137
]
138138
}

‎Solutions/Google Threat Intelligence/Playbooks/GTIThreatList/azuredeploy.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,9 +95,9 @@
9595
},
9696
"For_each": {
9797
"type": "Foreach",
98-
"foreach": "@chunk(body('get_threat_list')?['indicators'],100)",
98+
"foreach": "@chunk(coalesce(body('get_threat_list')?['indicators'],body('get_threat_list')?['stixobjects']),100)",
9999
"actions": {
100-
"Threat_Intelligence_-_Upload_Indicators_of_Compromise_(V2)_(Preview)": {
100+
"Threat_Intelligence_-_Upload_STIX_Objects_(Preview)": {
101101
"type": "ApiConnection",
102102
"inputs": {
103103
"host": {
@@ -108,9 +108,9 @@
108108
"method": "post",
109109
"body": {
110110
"sourcesystem": "Google Threat Intelligence",
111-
"indicators": "@items('For_each')"
111+
"stixobjects": "@items('For_each')"
112112
},
113-
"path": "/V2/ThreatIntelligence/@{encodeURIComponent('')}/UploadIndicators/"
113+
"path": "/ThreatIntelligence/@{encodeURIComponent('')}/UploadStixObjects/"
114114
}
115115
}
116116
},

‎Solutions/Google Threat Intelligence/ReleaseNotes.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|------------------------------------------------|
3-
| 3.2.2 | 23-09-2025 | Filter Threat Lists
3+
| 3.2.2 | 29-08-2025 | Filtering threat lists and migrating to Upload STIX Objects |
44
| 3.2.1 | 25-08-2025 | Fix IocStream ingestion bug. |
5-
| 3.2.0 | 20-05-2025 | New **Playbook** added *IoC Stream Threat Intelligence*.<br/> Added x-tool header in **Playbook** Customer Connector. |
6-
| 3.1.0 | 29-01-2025 | New *Threat Intelligence Ingestion* **Playbook** added. |
5+
| 3.2.0 | 20-05-2025 | New **Playbook** added *IoC Stream Threat Intelligence*.<br/> Added x-tool header in **Playbook** Customer Connector. |
6+
| 3.1.0 | 29-01-2025 | New *Threat Intelligence Ingestion* **Playbook** added. |
77
| 3.0.0 | 05-12-2024 | Initial Solution Release. |

0 commit comments

Comments
 (0)