Skip to content

Commit f914d93

Browse files
throuxelthrouxel
authored
[silentpush-enrichment] Verify connector (#5169)
1 parent ca257df commit f914d93

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1540
-1761
lines changed

‎internal-enrichment/silentpush-enrichment/.env.sample‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,16 @@
1-
OPENCTI_TOKEN=changeme
2-
SILENTPUSH_API_KEY=YOUR-SILENT-PUSH-API-KEY
1+
# Generic parameters (connection with OpenCTI)
2+
OPENCTI_URL=http://opencti:8080
3+
OPENCTI_TOKEN=CHANGEME
4+
5+
# Common parameters for connectors
6+
# CONNECTOR_ID=9955194d-d000-4507-bc9d-19f851c20de9
7+
# CONNECTOR_NAME=Silent Push - Enrichment
8+
# CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
9+
# CONNECTOR_LOG_LEVEL=error
10+
# CONNECTOR_AUTO=false
11+
12+
# Custom parameters for connector-silentpush
13+
# SILENTPUSH_API_BASE_URL=https://app.silentpush.com/api/v2/
14+
SILENTPUSH_API_KEY=CHANGEME
15+
# SILENTPUSH_MAX_TLP_LEVEL=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
16+
# SILENTPUSH_VERIFY_CERT=true

‎internal-enrichment/silentpush-enrichment/Dockerfile‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,16 @@
1-
FROM python:3.12-alpine as silentpush-enrichment
2-
3-
LABEL authors="[email protected]"
4-
5-
ENV CONNECTOR_TYPE=INTERNAL_ENRICHMENT
6-
ENV CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name,Hostname
1+
FROM python:3.12-alpine
72

83
# Copy the connector
9-
COPY src /opt/silentpush-enrichment
4+
COPY src /opt/opencti-connector-silentpush-enrichment
5+
WORKDIR /opt/opencti-connector-silentpush-enrichment
106

117
# Install Python modules
128
# hadolint ignore=DL3003
139
RUN apk update && apk upgrade && \
1410
apk --no-cache add git build-base libmagic libffi-dev libxml2-dev libxslt-dev
1511

16-
RUN cd /opt/silentpush-enrichment && \
12+
RUN cd /opt/opencti-connector-silentpush-enrichment && \
1713
pip3 install --no-cache-dir -r requirements.txt && \
1814
apk del git build-base
1915

20-
# Expose and entrypoint
21-
COPY entrypoint.sh /
22-
RUN chmod +x /entrypoint.sh
23-
ENTRYPOINT ["/entrypoint.sh"]
16+
CMD ["python", "main.py"]

‎internal-enrichment/silentpush-enrichment/README.md‎

Lines changed: 9 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -28,45 +28,17 @@ We apply unique behavioral fingerprints to attacker activity and search across o
2828

2929
### Requirements
3030

31-
- OpenCTI Platform >= 6.4.2
31+
- Python >= 3.11
32+
- OpenCTI Platform >= 6.8.13
33+
- [`pycti`](https://pypi.org/project/pycti/) library matching your OpenCTI version
34+
- [`connectors-sdk`](https://github.com/OpenCTI-Platform/connectors.git@master#subdirectory=connectors-sdk) library matching your OpenCTI version
3235

3336
## Configuration variables
3437

35-
There are a number of configuration options, which are set either in `docker-compose.yml` (for Docker) or
36-
in `config.yml` (for manual deployment).
38+
Find all the configuration variables available here: [Connector Configurations](./__metadata__/CONNECTOR_CONFIG_DOC.md)
3739

38-
### OpenCTI environment variables
39-
40-
Below are the parameters you'll need to set for OpenCTI:
41-
42-
| Parameter | config.yml | Docker environment variable | Mandatory | Description |
43-
|---------------|------------|-----------------------------|-----------|------------------------------------------------------|
44-
| OpenCTI URL | url | `OPENCTI_URL` | Yes | The URL of the OpenCTI platform. |
45-
| OpenCTI Token | token | `OPENCTI_TOKEN` | Yes | The default admin token set in the OpenCTI platform. |
46-
47-
### Base connector environment variables
48-
49-
Below are the parameters you'll need to set for running the connector properly:
50-
51-
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
52-
|-----------------|-----------------|-----------------------------|---------|-----------|------------------------------------------------------------------------------------------|
53-
| Connector ID | id | `CONNECTOR_ID` | / | Yes | A unique `UUIDv4` identifier for this connector instance. |
54-
| Connector Type | type | `CONNECTOR_TYPE` | | Yes | Should always be set to `INTERNAL_ENRICHMENT` for this connector. |
55-
| Connector Name | name | `CONNECTOR_NAME` | | Yes | Name of the connector. |
56-
| Connector Scope | scope | `CONNECTOR_SCOPE` | | Yes | The scope or type of data the connector is importing, either a MIME type or Stix Object. |
57-
| Log Level | log_level | `CONNECTOR_LOG_LEVEL` | info | Yes | Determines the verbosity of the logs. Options are `debug`, `info`, `warn`, or `error`. |
58-
| Connector Auto | connector_auto | `CONNECTOR_AUTO` | True | Yes | Must be `true` or `false` to enable or disable auto-enrichment of observables |
59-
60-
### Connector extra parameters environment variables
61-
62-
Below are the parameters you'll need to set for the connector:
63-
64-
| Parameter | config.yml | Docker environment variable | Default | Mandatory | Description |
65-
|-----------------------------------|--------------|-----------------------------|------------------------------------|-----------|-------------------------------------------------------------------------|
66-
| API base URL | api_base_url | SILENTPUSH_API_BASE_URL | https://app.silentpush.com/api/v1/ | No | The Silent Push API URL |
67-
| API key | api_key | SILENTPUSH_API_KEY | | Yes | You need an API key, sign up at https://explore.silentpush.com/register |
68-
| Signed or self signed Certificate | verify_cert | SILENTPUSH_VERIFY_CERT | True | No | |
69-
| TLP classification | max_tlp | | | No | |
40+
_The `opencti` and `connector` options in the `docker-compose.yml` and `config.yml` are the same as for any other connector.
41+
For more information regarding these variables, please refer to [OpenCTI's documentation on connectors](https://docs.opencti.io/latest/deployment/connectors/)._
7042

7143
## Deployment
7244

@@ -106,7 +78,7 @@ Install the required python dependencies (preferably in a virtual environment):
10678
pip3 install -r requirements.txt
10779
```
10880

109-
Then, start the connector from silentpush-enrichment/src:
81+
Then, start the connector from `src` directory:
11082

11183
```shell
11284
python3 main.py
@@ -128,15 +100,13 @@ download of data by re-running the connector.
128100
This connector enriches Domains, IPv4, IPv6 and URLs observables.
129101
Also enriches indicators containing those types of observables.
130102

131-
132103
## Debugging
133104

134105
The connector can be debugged by setting the appropiate log level.
135106
Note that logging messages can be added using `self.helper.connector_logger,{LOG_LEVEL}("Sample message")`, i.
136107
e., `self.helper.connector_logger.error("An error message")`.
137108

138-
<!-- Any additional information to help future users debug and report detailed issues concerning this connector -->
139109

140110
## Additional information
141111

142-
Anything needed please talk to us at [[email protected]](mailto:[email protected])
112+
Anything needed please talk to us at [[email protected]](mailto:[email protected])

‎internal-enrichment/silentpush-enrichment/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | The API token to connect to OpenCTI. |
11+
| SILENTPUSH_API_KEY | `string` | ✅ | Format: [`password`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | API key for authentication. |
12+
| CONNECTOR_NAME | `string` | | string | `"Silent Push - Enrichment"` | The name of the connector. |
13+
| CONNECTOR_SCOPE | `array` | | string | `["Indicator", "IPv4-Addr", "IPv6-Addr", "Domain-Name", "Hostname", "URL"]` | The scope of the connector |
14+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
15+
| CONNECTOR_TYPE | `const` | | `INTERNAL_ENRICHMENT` | `"INTERNAL_ENRICHMENT"` | |
16+
| CONNECTOR_AUTO | `boolean` | | boolean | `false` | Whether the connector should run automatically when an entity is created or updated. |
17+
| SILENTPUSH_API_BASE_URL | `string` | | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"https://app.silentpush.com/api/v2/"` | External API base URL. |
18+
| SILENTPUSH_MAX_TLP | `string` | | `TLP:WHITE` `TLP:CLEAR` `TLP:GREEN` `TLP:AMBER` `TLP:AMBER+STRICT` `TLP:RED` | `"TLP:AMBER"` | Max TLP level of the entities to enrich. |
19+
| SILENTPUSH_VERIFY_CERT | `boolean` | | boolean | `true` | Whether to verify SSL certificates when connecting to the API. |

‎internal-enrichment/silentpush-enrichment/__metadata__/connector_config_schema.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://www.filigran.io/connectors/silentpush-enrichment_config.schema.json",
4+
"type": "object",
5+
"properties": {
6+
"OPENCTI_URL": {
7+
"description": "The base URL of the OpenCTI instance.",
8+
"format": "uri",
9+
"maxLength": 2083,
10+
"minLength": 1,
11+
"type": "string"
12+
},
13+
"OPENCTI_TOKEN": {
14+
"description": "The API token to connect to OpenCTI.",
15+
"type": "string"
16+
},
17+
"CONNECTOR_NAME": {
18+
"default": "Silent Push - Enrichment",
19+
"description": "The name of the connector.",
20+
"type": "string"
21+
},
22+
"CONNECTOR_SCOPE": {
23+
"default": [
24+
"Indicator",
25+
"IPv4-Addr",
26+
"IPv6-Addr",
27+
"Domain-Name",
28+
"Hostname",
29+
"URL"
30+
],
31+
"description": "The scope of the connector",
32+
"items": {
33+
"type": "string"
34+
},
35+
"type": "array"
36+
},
37+
"CONNECTOR_LOG_LEVEL": {
38+
"default": "error",
39+
"description": "The minimum level of logs to display.",
40+
"enum": [
41+
"debug",
42+
"info",
43+
"warn",
44+
"warning",
45+
"error"
46+
],
47+
"type": "string"
48+
},
49+
"CONNECTOR_TYPE": {
50+
"const": "INTERNAL_ENRICHMENT",
51+
"default": "INTERNAL_ENRICHMENT",
52+
"type": "string"
53+
},
54+
"CONNECTOR_AUTO": {
55+
"default": false,
56+
"description": "Whether the connector should run automatically when an entity is created or updated.",
57+
"type": "boolean"
58+
},
59+
"SILENTPUSH_API_BASE_URL": {
60+
"default": "https://app.silentpush.com/api/v2/",
61+
"description": "External API base URL.",
62+
"format": "uri",
63+
"maxLength": 2083,
64+
"minLength": 1,
65+
"type": "string"
66+
},
67+
"SILENTPUSH_API_KEY": {
68+
"description": "API key for authentication.",
69+
"format": "password",
70+
"type": "string",
71+
"writeOnly": true
72+
},
73+
"SILENTPUSH_MAX_TLP": {
74+
"default": "TLP:AMBER",
75+
"description": "Max TLP level of the entities to enrich.",
76+
"enum": [
77+
"TLP:WHITE",
78+
"TLP:CLEAR",
79+
"TLP:GREEN",
80+
"TLP:AMBER",
81+
"TLP:AMBER+STRICT",
82+
"TLP:RED"
83+
],
84+
"type": "string"
85+
},
86+
"SILENTPUSH_VERIFY_CERT": {
87+
"default": true,
88+
"description": "Whether to verify SSL certificates when connecting to the API.",
89+
"type": "boolean"
90+
}
91+
},
92+
"required": [
93+
"OPENCTI_URL",
94+
"OPENCTI_TOKEN",
95+
"SILENTPUSH_API_KEY"
96+
],
97+
"additionalProperties": true
98+
}

‎internal-enrichment/silentpush-enrichment/__metadata__/connector_manifest.json‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,15 @@
44
"description": "Silent Push takes a unique approach to identifying developing cyber threats by creating Indicators of Future Attacks (IOFA) that are more useful, and more valuable than industry-standard IOCs.\n\nWe apply unique behavioral fingerprints to attacker activity and search across our proprietary DNS database \u2013 containing the most complete, accurate, and timely view of global internet-facing infrastructure anywhere in the world \u2013 to reveal adversary infrastructure and campaigns prior to launch.\n",
55
"short_description": "Silent Push takes a unique approach to identifying developing cyber threats by creating Indicators of Future Attacks (IOFA) that are more useful, and more valuable than industry-standard IOCs.\n",
66
"logo": "internal-enrichment/silentpush-enrichment/__metadata__/logo.png",
7-
"use_cases": [
8-
"Enrichment & Analysis"
9-
],
10-
"verified": false,
11-
"last_verified_date": null,
7+
"use_cases" : ["Enrichment & Analysis"],
8+
"verified": true,
9+
"last_verified_date": "2025-12-16",
1210
"playbook_supported": true,
1311
"max_confidence_level": 50,
14-
"support_version": ">=6.6.18",
12+
"support_version": ">=6.8.12",
1513
"subscription_link": null,
1614
"source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/internal-enrichment/silentpush-enrichment",
17-
"manager_supported": false,
15+
"manager_supported": true,
1816
"container_version": "rolling",
1917
"container_image": "opencti/connector-silentpush-enrichment",
2018
"container_type": "INTERNAL_ENRICHMENT"

‎internal-enrichment/silentpush-enrichment/config.yml.sample‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
opencti:
2+
url: 'http://opencti:8080'
3+
token: 'changeme'
4+
5+
connector:
6+
# id: '9955194d-d000-4507-bc9d-19f851c20de9'
7+
# name: 'Silent Push - Enrichment'
8+
# scope: 'Indicator,IPv4-Addr,IPv6-Addr,Domain-Name,Hostname,URL'
9+
# log_level: 'error'
10+
# auto: false # Enable/disable auto-enrichment of observables
11+
12+
silentpush:
13+
# api_base_url: 'https://app.silentpush.com/api/v2/'
14+
api_key: 'YOUR-SILENT-PUSH-API-KEY'
15+
# verify_cert: true
16+
# max_tlp: "TLP:AMBER" # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED

‎internal-enrichment/silentpush-enrichment/docker-compose.yml‎

Lines changed: 13 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,19 @@ services:
22
connector-silentpush:
33
image: opencti/connector-silentpush-enrichment:latest
44
environment:
5-
# Connector's generic execution parameters
5+
# Generic parameters (connection with OpenCTI)
66
- OPENCTI_URL=http://opencti:8080
7-
- OPENCTI_TOKEN=${OPENCTI_TOKEN}
8-
# Connector's definition parameters REQUIRED
9-
- CONNECTOR_ID=silentpush
10-
- CONNECTOR_NAME=SilentPush
11-
- CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
12-
- CONNECTOR_LOG_LEVEL=info
13-
- CONNECTOR_AUTO=false
14-
15-
# Connector's custom execution parameters
16-
- SILENTPUSH_API_BASE_URL=https://app.silentpush.com/api/v1/
17-
- SILENTPUSH_API_KEY=${SILENTPUSH_API_KEY}
18-
- SILENTPUSH_VERIFY_CERT=true
19-
- SILENTPUSH_MAX_TLP=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
20-
21-
# Add proxy parameters below if needed
22-
# - HTTP_PROXY=CHANGEME
23-
# - HTTPS_PROXY=CHANGEME
24-
# - NO_PROXY=CHANGEME
7+
- OPENCTI_TOKEN=CHANGEME
8+
# Common parameters for connectors
9+
# - CONNECTOR_ID=9955194d-d000-4507-bc9d-19f851c20de9
10+
# - CONNECTOR_NAME=Silent Push - Enrichment
11+
# - CONNECTOR_SCOPE=Indicator,URL,IPv4-Addr,IPv6-Addr,Domain-Name
12+
# - CONNECTOR_LOG_LEVEL=error
13+
# - CONNECTOR_AUTO=false
14+
# Custom parameters for connector-silentpush
15+
# - SILENTPUSH_API_BASE_URL=https://app.silentpush.com/api/v2/
16+
- SILENTPUSH_API_KEY=CHANGEME
17+
# - SILENTPUSH_MAX_TLP_LEVEL=TLP:CLEAR # Available values: TLP:CLEAR, TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED
18+
# - SILENTPUSH_VERIFY_CERT=true
2519
restart: always
26-
# network_mode: "host"
27-
# networks:
28-
# - external
2920

30-
#networks:
31-
# default:
32-
# external: true
33-
# name: external

‎internal-enrichment/silentpush-enrichment/entrypoint.sh‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎internal-enrichment/silentpush-enrichment/src/config.yml.sample‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)