Skip to content

Commit 3320b72

Browse files
firatesatoglufiratesatoglu
authored
Echo CTI connector (#5478)
1 parent e7e17a2 commit 3320b72

File tree

14 files changed

+1043
-0
lines changed

14 files changed

+1043
-0
lines changed

‎external-import/echocti/Dockerfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
FROM python:3.12-alpine
2+
ENV CONNECTOR_TYPE=EXTERNAL_IMPORT
3+
4+
COPY requirements.txt /opt/opencti-connector-echocti/
5+
6+
RUN apk update && apk upgrade && \
7+
apk --no-cache add git build-base libmagic libffi-dev && \
8+
cd /opt/opencti-connector-echocti && \
9+
pip install --no-cache-dir -r requirements.txt && \
10+
apk del git build-base && \
11+
rm -rf /var/cache/apk/*
12+
13+
# Copy the connector
14+
COPY src /opt/opencti-connector-echocti
15+
16+
# Expose and entrypoint
17+
COPY entrypoint.sh /
18+
RUN chmod +x /entrypoint.sh
19+
ENTRYPOINT ["/entrypoint.sh"]

‎external-import/echocti/README.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Echo CTI External Import Connector
2+
3+
The OpenCTI Echo CTI connector can be used to import threat intelligence data (IOCs) from the Echo CTI platform.
4+
The connector fetches indicators such as IPs, URLs, hashes, and IP ranges from the Echo CTI API and imports them into OpenCTI.
5+
6+
## Installation
7+
8+
The OpenCTI Echo CTI connector is a standalone Python process that must have access
9+
to the OpenCTI platform and RabbitMQ. RabbitMQ credentials and connection parameters
10+
are provided by the API directly, as configured in the platform settings.
11+
12+
Enabling this connector can be done by launching the Python process directly after
13+
providing the correct configuration in the `config.yml` file or within a Docker with
14+
the image `opencti/connector-echocti:latest`. We provide an example of
15+
[`docker-compose.yml`](docker-compose.yml) file that can be used independently or
16+
integrated into the global `docker-compose.yml` file of OpenCTI.
17+
18+
If you are using it independently, remember that the connector will try to connect to
19+
the RabbitMQ on the port configured in the OpenCTI platform.
20+
21+
### Configuration variables
22+
23+
Below are the parameters you'll need to set for OpenCTI:
24+
25+
| Parameter `OpenCTI` | config.yml | Docker environment variable | Mandatory | Description |
26+
|---------------------|------------|-----------------------------|-----------|------------------------------------------------------|
27+
| URL | url | `OPENCTI_URL` | Yes | The URL of the OpenCTI platform. |
28+
| Token | token | `OPENCTI_TOKEN` | Yes | The default admin token set in the OpenCTI platform. |
29+
30+
Below are the parameters you'll need to set for running the connector properly:
31+
32+
| Parameter `Connector` | config.yml | Docker environment variable | Default | Mandatory | Description |
33+
|-----------------------|---------------------|-------------------------------|-------------|-----------|--------------------------------------------------------------------------------------------------|
34+
| ID | `id` | `CONNECTOR_ID` | / | Yes | A unique `UUIDv4` identifier for this connector instance. |
35+
| Name | `name` | `CONNECTOR_NAME` | `Echo CTI` | Yes | Full name of the connector: `Echo CTI`. |
36+
| Scope | `scope` | `CONNECTOR_SCOPE` | `echocti` | Yes | Must be `echocti`, not used in this connector. |
37+
| Run and Terminate | `run_and_terminate` | `CONNECTOR_RUN_AND_TERMINATE` | `False` | No | Launch the connector once if set to True. Takes 2 available values: `True` or `False`. |
38+
| Duration Period | `duration_period` | `CONNECTOR_DURATION_PERIOD` | / | Yes | Determines the time interval between each launch of the connector in ISO 8601, ex: `PT1H`. |
39+
| Queue Threshold | `queue_threshold` | `CONNECTOR_QUEUE_THRESHOLD` | `500` | No | Used to determine the limit (RabbitMQ) in MB at which the connector must go into buffering mode. |
40+
| Log Level | `log_level` | `CONNECTOR_LOG_LEVEL` | / | Yes | Determines the verbosity of the logs. Options are `debug`, `info`, `warn`, or `error`. |
41+
42+
Below are the parameters you'll need to set for Echo CTI connector:
43+
44+
| Parameter `Echo CTI` | config.yml | Docker environment variable | Default | Mandatory | Description |
45+
|----------------------------|----------------------|--------------------------------|------------------------------------------|-----------|--------------------------------------------------------------------------------------------|
46+
| API URL | `api_url` | `ECHOCTI_API_URL` | `https://api.echocti.com/ioc2/feeds` | No | The Echo CTI API endpoint URL. |
47+
| Client ID | `client_id` | `ECHOCTI_CLIENT_ID` | `ChangeMe` | Yes | Your Echo CTI client ID. |
48+
| Client Secret | `client_secret` | `ECHOCTI_CLIENT_SECRET` | `ChangeMe` | Yes | Your Echo CTI client secret. |
49+
| Verify SSL | `verify_ssl` | `ECHOCTI_VERIFY_SSL` | `true` | No | Whether to verify SSL certificates. |
50+
| Type | `type` | `ECHOCTI_TYPE` | `all` | No | IOC type filter: `ip`, `url`, `hash`, `ip-range`, `all` (comma-separated for multiple). |
51+
| State | `state` | `ECHOCTI_STATE` | `active` | No | IOC state filter: `active`, `removed`, `false-positive`, `white-listed`, `all`. |
52+
| Time Since Created | `time_since_created` | `ECHOCTI_TIME_SINCE_CREATED` | / | No | Time filter for creation: `1h`, `1d`, `7d`, `30d`, `1y`. |
53+
| Time Since Updated | `time_since_updated` | `ECHOCTI_TIME_SINCE_UPDATED` | / | No | Time filter for last update: `1h`, `1d`, `7d`, `30d`, `1y`. |
54+
| Max Count | `max_count` | `ECHOCTI_MAX_COUNT` | `0` | No | Maximum number of IOCs to fetch (0 = all). |
55+
| Vendor | `vendor` | `ECHOCTI_VENDOR` | / | No | Optional vendor filter. |
56+
| Tag | `tag` | `ECHOCTI_TAG` | / | No | Optional tag filter. |
57+
| Default Confidence | `default_confidence` | `ECHOCTI_DEFAULT_CONFIDENCE` | `50` | No | Default confidence score for indicators (0-100). |
58+
59+
## Deployment
60+
61+
### Docker Deployment
62+
63+
Build and run the connector using Docker:
64+
65+
```bash
66+
docker build -t opencti/connector-echocti:latest .
67+
docker compose up -d
68+
```
69+
70+
### Manual Deployment
71+
72+
1. Install dependencies:
73+
```bash
74+
pip install -r requirements.txt
75+
```
76+
77+
2. Copy and configure the sample configuration:
78+
```bash
79+
cp src/config.yml.sample src/config.yml
80+
# Edit src/config.yml with your settings
81+
```
82+
83+
3. Run the connector:
84+
```bash
85+
cd src
86+
python -m echocti
87+
```
88+
89+
## Behavior
90+
91+
The connector will:
92+
1. Connect to the Echo CTI API using the provided credentials
93+
2. Fetch IOCs based on the configured filters (type, state, time range, etc.)
94+
3. Convert the IOCs to STIX 2.1 format
95+
4. Send the STIX bundle to OpenCTI
96+
5. Wait for the configured duration period before the next run

‎external-import/echocti/__metadata__/connector_manifest.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"title": "Echo CTI",
3+
"slug": "echocti",
4+
"description": "The Echo CTI connector imports threat intelligence data (IOCs) from the Echo CTI platform into OpenCTI. It fetches indicators such as IP addresses, URLs, file hashes, and IP ranges from the Echo CTI API and converts them to STIX 2.1 format for seamless integration with OpenCTI.",
5+
"short_description": "Import IOCs (IP, URL, Hash, IP-Range) from Echo CTI threat intelligence platform into OpenCTI.",
6+
"logo": "external-import/echocti/__metadata__/logo.png",
7+
"use_cases": [
8+
"Threat Intelligence",
9+
"IOC Enrichment"
10+
],
11+
"verified": false,
12+
"last_verified_date": null,
13+
"playbook_supported": false,
14+
"max_confidence_level": 50,
15+
"support_version": ">=6.0.0",
16+
"subscription_link": null,
17+
"source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/echocti",
18+
"manager_supported": false,
19+
"container_version": "rolling",
20+
"container_image": "opencti/connector-echocti",
21+
"container_type": "EXTERNAL_IMPORT"
22+
}

‎external-import/echocti/__metadata__/logo.png‎

4.35 MB
Loading

‎external-import/echocti/connectors‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Subproject commit 3db20082703762c4733f172170b0e09174a29297

‎external-import/echocti/docker-compose.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
version: '3'
2+
services:
3+
connector-echocti:
4+
image: opencti/connector-echocti:latest
5+
environment:
6+
- OPENCTI_URL=http://opencti:8080
7+
- OPENCTI_TOKEN=ChangeMe
8+
- CONNECTOR_ID=ChangeMe
9+
- CONNECTOR_NAME=Echo CTI
10+
- CONNECTOR_SCOPE=echocti
11+
- CONNECTOR_LOG_LEVEL=error
12+
- CONNECTOR_DURATION_PERIOD=PT1H # In ISO8601 Format starting with "P" for Period ex: "PT1H" = Period time of 1 hour
13+
- ECHOCTI_API_URL=https://api.echocti.com/ioc2/feeds
14+
- ECHOCTI_CLIENT_ID=ChangeMe
15+
- ECHOCTI_CLIENT_SECRET=ChangeMe
16+
- ECHOCTI_VERIFY_SSL=true
17+
- ECHOCTI_TYPE=all # IOC type: ip, url, hash, ip-range, all
18+
- ECHOCTI_STATE=active # IOC state: active, removed, false-positive, white-listed, all
19+
- ECHOCTI_TIME_SINCE_CREATED= # Time filter: 1h, 1d, 7d, 30d, 1y
20+
- ECHOCTI_TIME_SINCE_UPDATED= # Time filter: 1h, 1d, 7d, 30d, 1y
21+
- ECHOCTI_MAX_COUNT=0 # Maximum IOC count (0 = all)
22+
- ECHOCTI_VENDOR= # Vendor filter (optional)
23+
- ECHOCTI_TAG= # Tag filter (optional)
24+
- ECHOCTI_DEFAULT_CONFIDENCE=50 # Default confidence score (0-100)
25+
restart: always

‎external-import/echocti/entrypoint.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/sh
2+
3+
# Correct working directory
4+
cd /opt/opencti-connector-echocti
5+
6+
# Start the connector
7+
python -m echocti

‎external-import/echocti/requirements.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pycti==6.9.4
2+
pydantic>=2.8.2,<3.0.0
3+
requests>=2.31.0
4+
pyyaml>=6.0
5+
stix2>=3.0.1
6+
python-dateutil>=2.8.2

‎external-import/echocti/src/config.yml.sample‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
opencti:
2+
url: 'http://localhost:8080'
3+
token: 'ChangeMe'
4+
5+
connector:
6+
id: 'ChangeMe'
7+
type: 'EXTERNAL_IMPORT'
8+
name: 'Echo CTI'
9+
scope: 'echocti'
10+
log_level: 'info'
11+
duration_period: 'PT1H' # ISO8601 Format starting with "P" for Period ex: "PT1H" // Period time of 1 hour
12+
13+
echocti:
14+
api_url: 'https://api.echocti.com/ioc2/feeds'
15+
client_id: 'ChangeMe'
16+
client_secret: 'ChangeMe'
17+
verify_ssl: true
18+
type: 'all' # IOC type: ip, url, hash, ip-range, all (comma-separated for multiple)
19+
state: 'active' # IOC state: active, removed, false-positive, white-listed, all
20+
time_since_created: null # Time filter: 1h, 1d, 7d, 30d, 1y
21+
time_since_updated: null # Time filter: 1h, 1d, 7d, 30d, 1y
22+
max_count: 0 # Maximum IOC count (0 = all)
23+
vendor: null # Vendor filter (optional)
24+
tag: null # Tag filter (optional)
25+
default_confidence: 50 # Default confidence score (0-100)

‎external-import/echocti/src/echocti/__init__.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
"""OpenCTI EchoCTI connector module."""
2+
3+
from echocti.core import EchoCTI
4+
5+
__all__ = ["EchoCTI"]

0 commit comments

Comments
 (0)