Skip to content

Commit 3c099b2

Browse files
throuxelthrouxel
committed
[silentpush-enrichment] Verify connector
1 parent 6ca8452 commit 3c099b2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1535
-1738
lines changed

‎internal-enrichment/silentpush-enrichment/.env.sample‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,16 @@
1-
OPENCTI_TOKEN=changeme
2-
SILENTPUSH_API_KEY=YOUR-SILENT-PUSH-API-KEY
1+
# Generic parameters (connection with OpenCTI)
2+
OPENCTI_URL=http://opencti:8080
3+
OPENCTI_TOKEN=CHANGEM
4+
5+
# Common parameters for connectors
6+
CONNECTOR_ID=CHANGEME
7+
# CONNECTOR_NAME=Silent Push - Enrichment
8+
# CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
9+
# CONNECTOR_LOG_LEVEL=error
10+
# CONNECTOR_AUTO=false
11+
12+
# Custom parameters for connector-silentpush
13+
SILENTPUSH_API_BASE_URL=CHANGEME
14+
SILENTPUSH_API_KEY=CHANGEME
15+
# SILENTPUSH_MAX_TLP_LEVEL=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
16+
# SILENTPUSH_VERIFY_CERT=true

‎internal-enrichment/silentpush-enrichment/Dockerfile‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,16 @@
1-
FROM python:3.12-alpine as silentpush-enrichment
2-
3-
LABEL authors="[email protected]"
4-
5-
ENV CONNECTOR_TYPE=INTERNAL_ENRICHMENT
6-
ENV CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name,Hostname
1+
FROM python:3.12-alpine
72

83
# Copy the connector
9-
COPY src /opt/silentpush-enrichment
4+
COPY src /opt/opencti-connector-silentpush-enrichment
5+
WORKDIR /opt/opencti-connector-silentpush-enrichment
106

117
# Install Python modules
128
# hadolint ignore=DL3003
139
RUN apk update && apk upgrade && \
1410
apk --no-cache add git build-base libmagic libffi-dev libxml2-dev libxslt-dev
1511

16-
RUN cd /opt/silentpush-enrichment && \
12+
RUN cd /opt/opencti-connector-silentpush-enrichment && \
1713
pip3 install --no-cache-dir -r requirements.txt && \
1814
apk del git build-base
1915

20-
# Expose and entrypoint
21-
COPY entrypoint.sh /
22-
RUN chmod +x /entrypoint.sh
23-
ENTRYPOINT ["/entrypoint.sh"]
16+
CMD ["python", "main.py"]

‎internal-enrichment/silentpush-enrichment/README.md‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,10 @@ We apply unique behavioral fingerprints to attacker activity and search across o
2828

2929
### Requirements
3030

31-
- OpenCTI Platform >= 6.4.2
31+
- Python >= 3.11
32+
- OpenCTI Platform >= 6.8.13
33+
- [`pycti`](https://pypi.org/project/pycti/) library matching your OpenCTI version
34+
- [`connectors-sdk`](https://github.com/OpenCTI-Platform/connectors.git@master#subdirectory=connectors-sdk) library matching your OpenCTI version
3235

3336
## Configuration variables
3437

@@ -40,33 +43,33 @@ in `config.yml` (for manual deployment).
4043
Below are the parameters you'll need to set for OpenCTI:
4144

4245
| Parameter | config.yml | Docker environment variable | Mandatory | Description |
43-
|---------------|------------|-----------------------------|-----------|------------------------------------------------------|
46+
| ------------- | ---------- | --------------------------- | --------- | ---------------------------------------------------- |
4447
| OpenCTI URL | url | `OPENCTI_URL` | Yes | The URL of the OpenCTI platform. |
4548
| OpenCTI Token | token | `OPENCTI_TOKEN` | Yes | The default admin token set in the OpenCTI platform. |
4649

4750
### Base connector environment variables
4851

4952
Below are the parameters you'll need to set for running the connector properly:
5053

51-
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
52-
|-----------------|-----------------|-----------------------------|---------|-----------|------------------------------------------------------------------------------------------|
53-
| Connector ID | id | `CONNECTOR_ID` | / | Yes | A unique `UUIDv4` identifier for this connector instance. |
54-
| Connector Type | type | `CONNECTOR_TYPE` | | Yes | Should always be set to `INTERNAL_ENRICHMENT` for this connector. |
55-
| Connector Name | name | `CONNECTOR_NAME` | | Yes | Name of the connector. |
56-
| Connector Scope | scope | `CONNECTOR_SCOPE` | | Yes | The scope or type of data the connector is importing, either a MIME type or Stix Object. |
57-
| Log Level | log_level | `CONNECTOR_LOG_LEVEL` | info | Yes | Determines the verbosity of the logs. Options are `debug`, `info`, `warn`, or `error`. |
58-
| Connector Auto | connector_auto | `CONNECTOR_AUTO` | True | Yes | Must be `true` or `false` to enable or disable auto-enrichment of observables |
54+
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
55+
| --------------- | -------------- | --------------------------- | --------------- | --------- | ---------------------------------------------------------------------------------------- |
56+
| Connector ID | id | `CONNECTOR_ID` | / | Yes | A unique `UUIDv4` identifier for this connector instance. |
57+
| Connector Type | type | `CONNECTOR_TYPE` | EXTERNAL_IMPORT | Yes | Should always be set to `INTERNAL_ENRICHMENT` for this connector. |
58+
| Connector Name | name | `CONNECTOR_NAME` | | Yes | Name of the connector. |
59+
| Connector Scope | scope | `CONNECTOR_SCOPE` | | Yes | The scope or type of data the connector is importing, either a MIME type or Stix Object. |
60+
| Log Level | log_level | `CONNECTOR_LOG_LEVEL` | info | Yes | Determines the verbosity of the logs. Options are `debug`, `info`, `warn`, or `error`. |
61+
| Connector Auto | connector_auto | `CONNECTOR_AUTO` | True | Yes | Must be `true` or `false` to enable or disable auto-enrichment of observables |
5962

6063
### Connector extra parameters environment variables
6164

6265
Below are the parameters you'll need to set for the connector:
6366

6467
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
6568
|-----------------------------------|--------------|-----------------------------|------------------------------------|-----------|-------------------------------------------------------------------------|
66-
| API base URL | api_base_url | SILENTPUSH_API_BASE_URL | https://app.silentpush.com/api/v1/ | No | The Silent Push API URL |
69+
| API base URL | api_base_url | SILENTPUSH_API_BASE_URL | https://app.silentpush.com/api/v2/ | No | The Silent Push API URL |
6770
| API key | api_key | SILENTPUSH_API_KEY | | Yes | You need an API key, sign up at https://explore.silentpush.com/register |
6871
| Signed or self signed Certificate | verify_cert | SILENTPUSH_VERIFY_CERT | True | No | |
69-
| TLP classification | max_tlp | | | No | |
72+
| TLP classification | max_tlp | SILENTPUSH_MAX_TLP | TLP:AMBER | No | |
7073

7174
## Deployment
7275

@@ -106,7 +109,7 @@ Install the required python dependencies (preferably in a virtual environment):
106109
pip3 install -r requirements.txt
107110
```
108111

109-
Then, start the connector from silentpush-enrichment/src:
112+
Then, start the connector from `src` directory:
110113

111114
```shell
112115
python3 main.py
@@ -128,15 +131,13 @@ download of data by re-running the connector.
128131
This connector enriches Domains, IPv4, IPv6 and URLs observables.
129132
Also enriches indicators containing those types of observables.
130133

131-
132134
## Debugging
133135

134136
The connector can be debugged by setting the appropiate log level.
135137
Note that logging messages can be added using `self.helper.connector_logger,{LOG_LEVEL}("Sample message")`, i.
136138
e., `self.helper.connector_logger.error("An error message")`.
137139

138-
<!-- Any additional information to help future users debug and report detailed issues concerning this connector -->
139140

140141
## Additional information
141142

142-
Anything needed please talk to us at [[email protected]](mailto:[email protected])
143+
Anything needed please talk to us at [[email protected]](mailto:[email protected])

‎internal-enrichment/silentpush-enrichment/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | The API token to connect to OpenCTI. |
11+
| CONNECTOR_SCOPE | `array` | ✅ | string | | The scope of the connector, e.g. 'flashpoint'. |
12+
| SILENTPUSH_API_KEY | `string` | ✅ | string | | API key for authentication. |
13+
| CONNECTOR_NAME | `string` | | string | `"SilentpushConnector"` | The name of the connector. |
14+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
15+
| CONNECTOR_TYPE | `const` | | `INTERNAL_ENRICHMENT` | `"INTERNAL_ENRICHMENT"` | |
16+
| CONNECTOR_AUTO | `boolean` | | boolean | `false` | Whether the connector should run automatically when an entity is created or updated. |
17+
| SILENTPUSH_API_BASE_URL | `string` | | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"https://app.silentpush.com/api/v2/"` | External API base URL. |
18+
| SILENTPUSH_MAX_TLP | `string` | | `TLP:WHITE` `TLP:CLEAR` `TLP:GREEN` `TLP:AMBER` `TLP:AMBER+STRICT` `TLP:RED` | `"TLP:AMBER"` | Max TLP level of the entities to enrich. |
19+
| SILENTPUSH_VERIFY_CERT | `boolean` | | boolean | `true` | Whether to verify SSL certificates when connecting to the API. |

‎internal-enrichment/silentpush-enrichment/__metadata__/connector_config_schema.json‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://www.filigran.io/connectors/silentpush-enrichment_config.schema.json",
4+
"type": "object",
5+
"properties": {
6+
"OPENCTI_URL": {
7+
"description": "The base URL of the OpenCTI instance.",
8+
"format": "uri",
9+
"maxLength": 2083,
10+
"minLength": 1,
11+
"type": "string"
12+
},
13+
"OPENCTI_TOKEN": {
14+
"description": "The API token to connect to OpenCTI.",
15+
"type": "string"
16+
},
17+
"CONNECTOR_NAME": {
18+
"default": "SilentpushConnector",
19+
"description": "The name of the connector.",
20+
"type": "string"
21+
},
22+
"CONNECTOR_SCOPE": {
23+
"description": "The scope of the connector, e.g. 'flashpoint'.",
24+
"items": {
25+
"type": "string"
26+
},
27+
"type": "array"
28+
},
29+
"CONNECTOR_LOG_LEVEL": {
30+
"default": "error",
31+
"description": "The minimum level of logs to display.",
32+
"enum": [
33+
"debug",
34+
"info",
35+
"warn",
36+
"warning",
37+
"error"
38+
],
39+
"type": "string"
40+
},
41+
"CONNECTOR_TYPE": {
42+
"const": "INTERNAL_ENRICHMENT",
43+
"default": "INTERNAL_ENRICHMENT",
44+
"type": "string"
45+
},
46+
"CONNECTOR_AUTO": {
47+
"default": false,
48+
"description": "Whether the connector should run automatically when an entity is created or updated.",
49+
"type": "boolean"
50+
},
51+
"SILENTPUSH_API_BASE_URL": {
52+
"default": "https://app.silentpush.com/api/v2/",
53+
"description": "External API base URL.",
54+
"format": "uri",
55+
"maxLength": 2083,
56+
"minLength": 1,
57+
"type": "string"
58+
},
59+
"SILENTPUSH_API_KEY": {
60+
"description": "API key for authentication.",
61+
"type": "string"
62+
},
63+
"SILENTPUSH_MAX_TLP": {
64+
"default": "TLP:AMBER",
65+
"description": "Max TLP level of the entities to enrich.",
66+
"enum": [
67+
"TLP:WHITE",
68+
"TLP:CLEAR",
69+
"TLP:GREEN",
70+
"TLP:AMBER",
71+
"TLP:AMBER+STRICT",
72+
"TLP:RED"
73+
],
74+
"type": "string"
75+
},
76+
"SILENTPUSH_VERIFY_CERT": {
77+
"default": true,
78+
"description": "Whether to verify SSL certificates when connecting to the API.",
79+
"type": "boolean"
80+
}
81+
},
82+
"required": [
83+
"OPENCTI_URL",
84+
"OPENCTI_TOKEN",
85+
"CONNECTOR_SCOPE",
86+
"SILENTPUSH_API_KEY"
87+
],
88+
"additionalProperties": true
89+
}

‎internal-enrichment/silentpush-enrichment/__metadata__/connector_manifest.json‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,12 @@
44
"description": "Silent Push takes a unique approach to identifying developing cyber threats by creating Indicators of Future Attacks (IOFA) that are more useful, and more valuable than industry-standard IOCs.\n\nWe apply unique behavioral fingerprints to attacker activity and search across our proprietary DNS database \u2013 containing the most complete, accurate, and timely view of global internet-facing infrastructure anywhere in the world \u2013 to reveal adversary infrastructure and campaigns prior to launch.\n",
55
"short_description": "Silent Push takes a unique approach to identifying developing cyber threats by creating Indicators of Future Attacks (IOFA) that are more useful, and more valuable than industry-standard IOCs.\n",
66
"logo": "internal-enrichment/silentpush-enrichment/__metadata__/logo.png",
7-
"use_cases": [
8-
"Enrichment & Analysis"
9-
],
10-
"verified": false,
11-
"last_verified_date": null,
7+
"use_cases" : ["Enrichment & Analysis"],
8+
"verified": true,
9+
"last_verified_date": "2025-12-16",
1210
"playbook_supported": true,
1311
"max_confidence_level": 50,
14-
"support_version": ">=6.6.18",
12+
"support_version": ">=6.8.12",
1513
"subscription_link": null,
1614
"source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/internal-enrichment/silentpush-enrichment",
1715
"manager_supported": false,

‎internal-enrichment/silentpush-enrichment/config.yml.sample‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
opencti:
2+
url: 'http://opencti:8080'
3+
token: 'changeme'
4+
5+
connector:
6+
id: 'changeme'
7+
type: 'INTERNAL_ENRICHMENT'
8+
# name: 'Silent Push - Enrichment'
9+
# scope: 'Indicator,IPv4-Addr,IPv6-Addr,Domain-Name,Hostname,URL'
10+
# log_level: 'error'
11+
# auto: false # Enable/disable auto-enrichment of observables
12+
13+
silentpush:
14+
api_base_url: 'https://app.silentpush.com/api/v2/'
15+
api_key: 'YOUR-SILENT-PUSH-API-KEY'
16+
# verify_cert: true
17+
# max_tlp: "TLP:AMBER" # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED

‎internal-enrichment/silentpush-enrichment/docker-compose.yml‎

Lines changed: 13 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,19 @@ services:
22
connector-silentpush:
33
image: opencti/connector-silentpush-enrichment:latest
44
environment:
5-
# Connector's generic execution parameters
5+
# Generic parameters (connection with OpenCTI)
66
- OPENCTI_URL=http://opencti:8080
7-
- OPENCTI_TOKEN=${OPENCTI_TOKEN}
8-
# Connector's definition parameters REQUIRED
9-
- CONNECTOR_ID=silentpush
10-
- CONNECTOR_NAME=SilentPush
11-
- CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
12-
- CONNECTOR_LOG_LEVEL=info
13-
- CONNECTOR_AUTO=false
14-
15-
# Connector's custom execution parameters
16-
- SILENTPUSH_API_BASE_URL=https://app.silentpush.com/api/v1/
17-
- SILENTPUSH_API_KEY=${SILENTPUSH_API_KEY}
18-
- SILENTPUSH_VERIFY_CERT=true
19-
- SILENTPUSH_MAX_TLP=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
20-
21-
# Add proxy parameters below if needed
22-
# - HTTP_PROXY=CHANGEME
23-
# - HTTPS_PROXY=CHANGEME
24-
# - NO_PROXY=CHANGEME
7+
- OPENCTI_TOKEN=CHANGEME
8+
# Common parameters for connectors
9+
- CONNECTOR_ID=CHANGEME
10+
# - CONNECTOR_NAME=Silent Push - Enrichment
11+
# - CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
12+
# - CONNECTOR_LOG_LEVEL=error
13+
# - CONNECTOR_AUTO=false
14+
# Custom parameters for connector-silentpush
15+
- SILENTPUSH_API_BASE_URL=CHANGEME
16+
- SILENTPUSH_API_KEY=CHANGEME
17+
# - SILENTPUSH_MAX_TLP_LEVEL=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
18+
# - SILENTPUSH_VERIFY_CERT=true
2519
restart: always
26-
# network_mode: "host"
27-
# networks:
28-
# - external
2920

30-
#networks:
31-
# default:
32-
# external: true
33-
# name: external

‎internal-enrichment/silentpush-enrichment/entrypoint.sh‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎internal-enrichment/silentpush-enrichment/src/config.yml.sample‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)