Skip to content

Commit 30b61a7

Browse files
Powlinettthrouxel
Powlinett
and
throuxel
authored
[disarm-framework] Update connector to be "manager_supported" (#5211)
Co-authored-by: Thibaut Rouxel <98959405+throuxel@users.noreply.github.com>
1 parent b2b0bff commit 30b61a7

File tree

17 files changed

+601
-251
lines changed

17 files changed

+601
-251
lines changed

‎external-import/disarm-framework/README.md‎

Lines changed: 41 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# OpenCTI DISARM Framework Connector
22

3-
| Status | Date | Comment |
4-
|--------|------|---------|
3+
| Status | Date | Comment |
4+
| ----------------- | ---- | ------- |
55
| Filigran Verified | - | - |
66

77
The DISARM Framework connector imports the DISARM (Disinformation Analysis and Risk Management) framework into OpenCTI, providing a structured approach for describing and countering disinformation campaigns.
@@ -40,31 +40,10 @@ The framework provides a common language for describing disinformation tactics a
4040

4141
## Configuration variables
4242

43-
There are a number of configuration options, which are set either in `docker-compose.yml` (for Docker) or in `config.yml` (for manual deployment).
43+
Find all the configuration variables available here: [Connector Configurations](./__metadata__/CONNECTOR_CONFIG_DOC.md)
4444

45-
### OpenCTI environment variables
46-
47-
| Parameter | config.yml | Docker environment variable | Mandatory | Description |
48-
|---------------|------------|-----------------------------|-----------|------------------------------------------------------|
49-
| OpenCTI URL | url | `OPENCTI_URL` | Yes | The URL of the OpenCTI platform. |
50-
| OpenCTI Token | token | `OPENCTI_TOKEN` | Yes | The default admin token set in the OpenCTI platform. |
51-
52-
### Base connector environment variables
53-
54-
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
55-
|----------------------|----------------------|----------------------------------|------------------|-----------|--------------------------------------------------------------------------|
56-
| Connector ID | id | `CONNECTOR_ID` | | Yes | A unique `UUIDv4` identifier for this connector instance. |
57-
| Connector Name | name | `CONNECTOR_NAME` | DISARM Framework | No | Name of the connector. |
58-
| Connector Scope | scope | `CONNECTOR_SCOPE` | attack-pattern | No | The scope or type of data the connector is importing. |
59-
| Log Level | log_level | `CONNECTOR_LOG_LEVEL` | info | No | Determines the verbosity of logs: `debug`, `info`, `warn`, or `error`. |
60-
| Update Existing Data | update_existing_data | `CONNECTOR_UPDATE_EXISTING_DATA` | true | No | Whether to update existing data in OpenCTI. |
61-
62-
### Connector extra parameters environment variables
63-
64-
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
65-
|---------------|--------------------------|-------------------------------|------------------------------------------------------------------------------------------------------------|-----------|----------------------------------------------------------------|
66-
| Framework URL | disarm_framework.url | `DISARM_FRAMEWORK_URL` | https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json | Yes | URL of the DISARM STIX bundle. |
67-
| Interval | disarm_framework.interval| `DISARM_FRAMEWORK_INTERVAL` | 7 | Yes | Polling interval in days. |
45+
_The `opencti` and `connector` options in the `docker-compose.yml` and `config.yml` are the same as for any other connector.
46+
For more information regarding variables, please refer to [OpenCTI's documentation on connectors](https://docs.opencti.io/latest/deployment/connectors/)._
6847

6948
## Deployment
7049

@@ -79,19 +58,19 @@ docker build -t opencti/connector-disarm-framework:latest .
7958
Configure the connector in `docker-compose.yml`:
8059

8160
```yaml
82-
connector-disarm-framework:
83-
image: opencti/connector-disarm-framework:latest
84-
environment:
85-
- OPENCTI_URL=http://localhost
86-
- OPENCTI_TOKEN=ChangeMe
87-
- CONNECTOR_ID=ChangeMe
88-
- CONNECTOR_NAME=DISARM Framework
89-
- CONNECTOR_SCOPE=attack-pattern
90-
- CONNECTOR_LOG_LEVEL=info
91-
- CONNECTOR_UPDATE_EXISTING_DATA=true
92-
- DISARM_FRAMEWORK_URL=https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json
93-
- DISARM_FRAMEWORK_INTERVAL=7
94-
restart: always
61+
connector-disarm-framework:
62+
image: opencti/connector-disarm-framework:latest
63+
environment:
64+
- OPENCTI_URL=http://localhost
65+
- OPENCTI_TOKEN=ChangeMe
66+
- CONNECTOR_ID=ChangeMe
67+
- CONNECTOR_NAME=DISARM Framework
68+
- CONNECTOR_SCOPE=attack-pattern
69+
- CONNECTOR_LOG_LEVEL=info
70+
- CONNECTOR_UPDATE_EXISTING_DATA=true
71+
- DISARM_FRAMEWORK_URL=https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json
72+
- DISARM_FRAMEWORK_INTERVAL=7
73+
restart: always
9574
```
9675
9776
Start the connector:
@@ -151,22 +130,22 @@ graph LR
151130

152131
### Entity Mapping
153132

154-
| DISARM Data | OpenCTI Entity | Description |
155-
|--------------------|---------------------|------------------------------------------------------|
156-
| Technique | Attack Pattern | Disinformation techniques mapped as STIX Attack Patterns |
157-
| Tactic | Kill Chain Phase | Tactics mapped as kill chain phases with `kill_chain_name: disarm` |
158-
| Framework Metadata | Identity | DISARM Foundation as author |
133+
| DISARM Data | OpenCTI Entity | Description |
134+
| ------------------ | ---------------- | ------------------------------------------------------------------ |
135+
| Technique | Attack Pattern | Disinformation techniques mapped as STIX Attack Patterns |
136+
| Tactic | Kill Chain Phase | Tactics mapped as kill chain phases with `kill_chain_name: disarm` |
137+
| Framework Metadata | Identity | DISARM Foundation as author |
159138

160139
### DISARM Framework Structure
161140

162141
The DISARM framework is organized into phases (similar to MITRE ATT&CK tactics):
163142

164-
| Phase | Description |
165-
|---------|-----------------------------------------|
166-
| Plan | Planning operations and objectives |
167-
| Prepare | Preparing resources and capabilities |
168-
| Execute | Executing the disinformation campaign |
169-
| Assess | Assessing impact and effectiveness |
143+
| Phase | Description |
144+
| ------- | ------------------------------------- |
145+
| Plan | Planning operations and objectives |
146+
| Prepare | Preparing resources and capabilities |
147+
| Execute | Executing the disinformation campaign |
148+
| Assess | Assessing impact and effectiveness |
170149

171150
### Processing Details
172151

@@ -192,6 +171,7 @@ CONNECTOR_LOG_LEVEL=debug
192171
```
193172

194173
Common issues:
174+
195175
- **Network errors**: Verify access to GitHub/DISARM URL
196176
- **Bundle format**: Ensure the STIX bundle is valid JSON
197177
- **Kill chain conflicts**: Check for naming conflicts with other frameworks
@@ -206,17 +186,17 @@ Common issues:
206186

207187
### Use Cases
208188

209-
| Use Case | Description |
210-
|------------------------|---------------------------------------------------|
211-
| Disinformation Analysis| Map observed disinformation to known techniques |
212-
| Campaign Attribution | Link campaigns to specific tactics/techniques |
213-
| Defense Planning | Develop countermeasures based on framework |
214-
| Reporting | Standardized language for threat reports |
189+
| Use Case | Description |
190+
| ----------------------- | ----------------------------------------------- |
191+
| Disinformation Analysis | Map observed disinformation to known techniques |
192+
| Campaign Attribution | Link campaigns to specific tactics/techniques |
193+
| Defense Planning | Develop countermeasures based on framework |
194+
| Reporting | Standardized language for threat reports |
215195

216196
### Related Frameworks
217197

218-
| Framework | Focus |
219-
|--------------------|--------------------------------------|
220-
| MITRE ATT&CK | Cyber attack techniques |
221-
| MITRE ATT&CK ICS | Industrial control systems |
222-
| DISARM | Disinformation and influence operations |
198+
| Framework | Focus |
199+
| ---------------- | --------------------------------------- |
200+
| MITRE ATT&CK | Cyber attack techniques |
201+
| MITRE ATT&CK ICS | Industrial control systems |
202+
| DISARM | Disinformation and influence operations |

‎external-import/disarm-framework/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | The API token to connect to OpenCTI. |
11+
| CONNECTOR_NAME | `string` | | string | `"DisarmFramework"` | The name of the connector. |
12+
| CONNECTOR_SCOPE | `array` | | string | `[]` | The scope of the connector. |
13+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
14+
| CONNECTOR_TYPE | `const` | | `EXTERNAL_IMPORT` | `"EXTERNAL_IMPORT"` | |
15+
| CONNECTOR_DURATION_PERIOD | `string` | | Format: [`duration`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"P7D"` | The period of time to await between two runs of the connector. |
16+
| DISARM_FRAMEWORK_URL | `string` | | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json"` | URL of the DISARM STIX bundle. |

‎external-import/disarm-framework/__metadata__/connector_config_schema.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://www.filigran.io/connectors/disarm-framework_config.schema.json",
4+
"type": "object",
5+
"properties": {
6+
"OPENCTI_URL": {
7+
"description": "The base URL of the OpenCTI instance.",
8+
"format": "uri",
9+
"maxLength": 2083,
10+
"minLength": 1,
11+
"type": "string"
12+
},
13+
"OPENCTI_TOKEN": {
14+
"description": "The API token to connect to OpenCTI.",
15+
"type": "string"
16+
},
17+
"CONNECTOR_NAME": {
18+
"default": "DisarmFramework",
19+
"description": "The name of the connector.",
20+
"type": "string"
21+
},
22+
"CONNECTOR_SCOPE": {
23+
"default": [],
24+
"description": "The scope of the connector.",
25+
"items": {
26+
"type": "string"
27+
},
28+
"type": "array"
29+
},
30+
"CONNECTOR_LOG_LEVEL": {
31+
"default": "error",
32+
"description": "The minimum level of logs to display.",
33+
"enum": [
34+
"debug",
35+
"info",
36+
"warn",
37+
"warning",
38+
"error"
39+
],
40+
"type": "string"
41+
},
42+
"CONNECTOR_TYPE": {
43+
"const": "EXTERNAL_IMPORT",
44+
"default": "EXTERNAL_IMPORT",
45+
"type": "string"
46+
},
47+
"CONNECTOR_DURATION_PERIOD": {
48+
"default": "P7D",
49+
"description": "The period of time to await between two runs of the connector.",
50+
"format": "duration",
51+
"type": "string"
52+
},
53+
"DISARM_FRAMEWORK_URL": {
54+
"default": "https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json",
55+
"description": "URL of the DISARM STIX bundle.",
56+
"format": "uri",
57+
"maxLength": 2083,
58+
"minLength": 1,
59+
"type": "string"
60+
}
61+
},
62+
"required": [
63+
"OPENCTI_URL",
64+
"OPENCTI_TOKEN"
65+
],
66+
"additionalProperties": true
67+
}

‎external-import/disarm-framework/__metadata__/connector_manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"support_version": ">= 6.5.1",
1616
"subscription_link": "https://github.com/DISARMFoundation/DISARMframeworks",
1717
"source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/disarm-framework",
18-
"manager_supported": false,
18+
"manager_supported": true,
1919
"container_version": "rolling",
2020
"container_image": "opencti/connector-disarm-framework",
2121
"container_type": "EXTERNAL_IMPORT"

‎external-import/disarm-framework/docker-compose.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,4 @@ services:
1111
- CONNECTOR_RUN_AND_TERMINATE=false
1212
- CONNECTOR_LOG_LEVEL=error
1313
- DISARM_FRAMEWORK_URL=https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json
14-
- DISARM_FRAMEWORK_INTERVAL=7 # In days, must be strictly greater than 1
1514
restart: always

‎external-import/disarm-framework/entrypoint.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
cd /opt/opencti-connector-disarm-framework
55

66
# Start the connector
7-
python3 disarm_framework.py
7+
python3 main.py

‎external-import/disarm-framework/src/config.yml.sample‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ opencti:
33
token: 'ChangeMe'
44

55
connector:
6-
type: 'EXTERNAL_IMPORT'
76
id: 'ChangeMe'
87
name: 'DISARM Framework'
98
scope: 'marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,report,narrative,event,channel'
@@ -12,4 +11,3 @@ connector:
1211

1312
disarm_framework:
1413
url: 'https://raw.githubusercontent.com/DISARMFoundation/DISARMframeworks/main/generated_files/DISARM_STIX/DISARM.json'
15-
interval: 7 # In days, must be strictly greater than 1

‎external-import/disarm-framework/src/connector/__init__.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
from connector.connector import DisarmFramework
2+
from connector.settings import ConnectorSettings
3+
4+
__all__ = [
5+
"DisarmFramework",
6+
"ConnectorSettings",
7+
]

0 commit comments

Comments
 (0)