Skip to content

Commit 0246a40

Browse files
committed
Add mapping
1 parent 09103e2 commit 0246a40

File tree

1 file changed

+108
-12
lines changed

1 file changed

+108
-12
lines changed

docs/security/threat-intelligence/threat-intelligence-mapping.md

Lines changed: 108 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ description: Learn about mapping of threat intelligence indicators to Sumo Logic
77

88
import useBaseUrl from '@docusaurus/useBaseUrl';
99

10-
## Global feed mapping
10+
## _sumo_global_feed_cs mapping
1111

1212
Sumo Logic provides an out-of-the-box a `_sumo_global_feed_cs` source of threat intelligence indicators supplied by CrowdStrike. You can see it in the [**Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab). This source is a default source and cannot be changed or deleted.
1313

@@ -27,6 +27,8 @@ In the threat intelligence datastore, the schema is mapped to normalized values
2727

2828
(All other fields will be kept in the `fields{}` object.)
2929

30+
### Type mapping for _sumo_global_feed_cs
31+
3032
The `type` object is mapped to the following normalized type values:
3133

3234
| Original type | Normalized type in the datastore |
@@ -51,21 +53,115 @@ The `type` object is mapped to the following normalized type values:
5153

5254
## CrowdStrike mapping
5355

54-
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md)
56+
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source).
5557

5658
In the threat intelligence datastore, the CrowdStrike schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
5759

58-
| CrowdStrike schema | Normalized schema in the datastore |
60+
| CrowdStrike schema | Normalized schema in the datastore | Notes |
61+
|:--|:--|:--|
62+
| `[]actors` | `actors` | Array joined with a ", " |
63+
| `id` | `id` | Array joined with a ", " |
64+
| `indicator` | `indicator` | |
65+
| `[]kill_chains` | `killChain` | |
66+
| `labels` | `threatType` | Value used can also be `malicious-activity`, `anomalous-activity`, or `unkown`.* |
67+
68+
*Value `malicious-activity` used if regex matches: `name=threattype\/(clickfraud|commodity|pointofsale|randomware|targeted|targetedcrimeware)` <br/>Value `anomalous-activity` used if regex matches: `name=threattype\/` <br/>Value `unknown` used if nothing matches.
69+
70+
## Intel471 mapping
71+
72+
You can ingest threat indicators from Intel471 using the [Intel471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/).
73+
74+
In the threat intelligence datastore, the Intel471 schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
75+
76+
| ThreatIntel 471 schema | Normalized schema in the datastore | Notes |
77+
|:--|:--|:--|
78+
| `activity.last` | `validFrom` | Converted from epoch timestamp. |
79+
| `data.expiration` | `validUntil` | Converted from epoch timestamp. |
80+
| `data.mitre_tactics` | `killChain` | |
81+
| `data.threat.uid` | `id` | |
82+
| | `threatType` | Statically set to `unknown`. |
83+
84+
## Mandiant mapping
85+
86+
You can ingest threat indicators from Mandiant using the [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source/).
87+
88+
In the threat intelligence datastore, the Mandiant schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
89+
90+
| Mandiant schema | Normalized schema in the datastore | Notes |
91+
|:--|:--|:--|
92+
| `[]actors` | `actors` | The JSON structure of individual actors are joined with a ", " |
93+
| `id` | `id` | |
94+
| `threat_rating.confidence_score` | `confidence` | |
95+
| `unknown` | `threatType` | |
96+
| `value` | `indicator` | |
97+
98+
## ZeroFox mapping
99+
100+
You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zerofox-intel-source/).
101+
102+
In the threat intelligence datastore, the ZeroFox schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
103+
104+
| Mandiant schema | Normalized schema in the datastore | Notes |
105+
|:--|:--|:--|
106+
| `c2_domain` | `indicator` | |
107+
| `c2_ip_address` | `indicator` | |
108+
| `created_at` | `validFrom` | If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
109+
| `domain` | `indicator` | |
110+
| `domain-name--{{domain}}` | `id` | |
111+
| `file:hashes.'SHA-1'` | `type` | |
112+
| `file:hashes.'SHA-1'--{{sha1}}` | `id` | |
113+
| `file:hashes.'SHA-256'` | `type` | |
114+
| `file:hashes.'SHA-256'--{{sha256}}` | `id` | |
115+
| `file:hashes.'SHA-512'` | `type` | |
116+
| `file:hashes.'SHA-512'--{{sha512}}` | `id` | |
117+
| `file:hashes.MD5` | `type` | |
118+
| `file:hashes.'MD5'--{{md5}}` | `id` | |
119+
| `ip` | `indicator` | | |
120+
| `ip_address` | `indicator` | |
121+
| `ipv4-addr--{{c2_domain}}` | `id` | |
122+
| `ipv4-addr--{{c2_ip_address}}` | `id` | |
123+
| `ipv4-addr--{{ip_address}}` | `id` | |
124+
| `ipv6-addr--{{c2_ip_address}}` | `id` | |
125+
| `listed_at` | `validFrom` | |
126+
| `md5` | `indicator` | |
127+
| `scanned` | `validFrom` | |
128+
| `sha1` | `indicator` | |
129+
| `sha256` | `indicator` | |
130+
| `sha512` | `indicator` | |
131+
| `tags` | `confidence` | Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag. |
132+
| `updated_at` | `validFrom` | If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
133+
| `url` | `indicator` | |
134+
| `url--{{url}}` | `id` | |
135+
| | `threatType` | Set to `compromised`. |
136+
137+
### Confidence mapping for ZeroFox
138+
139+
The `confidence` field in the datastore has the following values for ZeroFox:
140+
141+
| ZeroFox item | Confidence score in datastore |
59142
|:--|:--|
60-
| `actor` | `actors` |
61-
| `id` | `id` |
62-
| `indicator` | `indicator` |
63-
| `kill_chain_phases` | `killChain` |
64-
| `labels.ThreatType` | `threatType` |
65-
| `last_updated` | `updated` |
66-
| `malicious_confidence` | `confidence` (normalized to the 0-100 scale) |
67-
| `published_date` | `validFrom` and `imported` |
68-
| `type` | `type` |
143+
| `domain` | `50` |
144+
| `ip` | `50` |
145+
| `ip_address` | `50` |
146+
| `ip_addresses` | `50` |
147+
| `md5` | `75` |
148+
| `sha1` | `75` |
149+
| `sha256` | `75` |
150+
| `sha512` | `75` |
151+
| `url` | `50` for phishing events, and `100` for disruption events |
152+
153+
### Type mapping for ZeroFox
69154

155+
The `type` object is mapped to the following normalized type values:
156+
157+
| Original type | Normalized type in the datastore |
158+
|:--|:--|
159+
| `c2_domain` | `domain-name` |
160+
| `c2_ip_address` | `ip_address` |
161+
| `domain` | `domain-name` |
162+
| `ip` | `ipv4-addr` |
163+
| `ip_address` | `ip_address` |
164+
| `Ip_addresses` | `ipv4-addr` or `ipv6-addr` |
165+
| `url` | `url` |
70166

71167

0 commit comments

Comments
 (0)