You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -7,7 +7,7 @@ description: Learn about mapping of threat intelligence indicators to Sumo Logic
7
7
8
8
import useBaseUrl from '@docusaurus/useBaseUrl';
9
9
10
-
## Global feed mapping
10
+
## _sumo_global_feed_cs mapping
11
11
12
12
Sumo Logic provides an out-of-the-box a `_sumo_global_feed_cs` source of threat intelligence indicators supplied by CrowdStrike. You can see it in the [**Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab). This source is a default source and cannot be changed or deleted.
13
13
@@ -27,6 +27,8 @@ In the threat intelligence datastore, the schema is mapped to normalized values
27
27
28
28
(All other fields will be kept in the `fields{}` object.)
29
29
30
+
### Type mapping for _sumo_global_feed_cs
31
+
30
32
The `type` object is mapped to the following normalized type values:
31
33
32
34
| Original type | Normalized type in the datastore |
@@ -51,21 +53,115 @@ The `type` object is mapped to the following normalized type values:
51
53
52
54
## CrowdStrike mapping
53
55
54
-
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md)
56
+
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source).
55
57
56
58
In the threat intelligence datastore, the CrowdStrike schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
57
59
58
-
| CrowdStrike schema | Normalized schema in the datastore |
60
+
| CrowdStrike schema | Normalized schema in the datastore | Notes |
61
+
|:--|:--|:--|
62
+
|`[]actors`|`actors`| Array joined with a ", " |
63
+
|`id`|`id`| Array joined with a ", " |
64
+
|`indicator`|`indicator`||
65
+
|`[]kill_chains`|`killChain`||
66
+
|`labels`|`threatType`| Value used can also be `malicious-activity`, `anomalous-activity`, or `unkown`.*|
67
+
68
+
*Value `malicious-activity` used if regex matches: `name=threattype\/(clickfraud|commodity|pointofsale|randomware|targeted|targetedcrimeware)` <br/>Value `anomalous-activity` used if regex matches: `name=threattype\/` <br/>Value `unknown` used if nothing matches.
69
+
70
+
## Intel471 mapping
71
+
72
+
You can ingest threat indicators from Intel471 using the [Intel471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/).
73
+
74
+
In the threat intelligence datastore, the Intel471 schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
75
+
76
+
| ThreatIntel 471 schema | Normalized schema in the datastore | Notes |
77
+
|:--|:--|:--|
78
+
|`activity.last`|`validFrom`| Converted from epoch timestamp. |
79
+
|`data.expiration`|`validUntil`| Converted from epoch timestamp. |
80
+
|`data.mitre_tactics`|`killChain`||
81
+
|`data.threat.uid`|`id`||
82
+
||`threatType`| Statically set to `unknown`. |
83
+
84
+
## Mandiant mapping
85
+
86
+
You can ingest threat indicators from Mandiant using the [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source/).
87
+
88
+
In the threat intelligence datastore, the Mandiant schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
89
+
90
+
| Mandiant schema | Normalized schema in the datastore | Notes |
91
+
|:--|:--|:--|
92
+
|`[]actors`|`actors`| The JSON structure of individual actors are joined with a ", " |
93
+
|`id`|`id`||
94
+
|`threat_rating.confidence_score`|`confidence`||
95
+
|`unknown`|`threatType`||
96
+
|`value`|`indicator`||
97
+
98
+
## ZeroFox mapping
99
+
100
+
You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zerofox-intel-source/).
101
+
102
+
In the threat intelligence datastore, the ZeroFox schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
103
+
104
+
| Mandiant schema | Normalized schema in the datastore | Notes |
105
+
|:--|:--|:--|
106
+
|`c2_domain`|`indicator`||
107
+
|`c2_ip_address`|`indicator`||
108
+
|`created_at`|`validFrom`| If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
109
+
|`domain`|`indicator`||
110
+
|`domain-name--{{domain}}`|`id`||
111
+
|`file:hashes.'SHA-1'`|`type`||
112
+
|`file:hashes.'SHA-1'--{{sha1}}`|`id`||
113
+
|`file:hashes.'SHA-256'`|`type`||
114
+
|`file:hashes.'SHA-256'--{{sha256}}`|`id`||
115
+
|`file:hashes.'SHA-512'`|`type`||
116
+
|`file:hashes.'SHA-512'--{{sha512}}`|`id`||
117
+
|`file:hashes.MD5`|`type`||
118
+
|`file:hashes.'MD5'--{{md5}}`|`id`||
119
+
|`ip`|`indicator`|||
120
+
|`ip_address`|`indicator`||
121
+
|`ipv4-addr--{{c2_domain}}`|`id`||
122
+
|`ipv4-addr--{{c2_ip_address}}`|`id`||
123
+
|`ipv4-addr--{{ip_address}}`|`id`||
124
+
|`ipv6-addr--{{c2_ip_address}}`|`id`||
125
+
|`listed_at`|`validFrom`||
126
+
|`md5`|`indicator`||
127
+
|`scanned`|`validFrom`||
128
+
|`sha1`|`indicator`||
129
+
|`sha256`|`indicator`||
130
+
|`sha512`|`indicator`||
131
+
|`tags`|`confidence`| Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag. |
132
+
|`updated_at`|`validFrom`| If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
133
+
|`url`|`indicator`||
134
+
|`url--{{url}}`|`id`||
135
+
||`threatType`| Set to `compromised`. |
136
+
137
+
### Confidence mapping for ZeroFox
138
+
139
+
The `confidence` field in the datastore has the following values for ZeroFox:
140
+
141
+
| ZeroFox item | Confidence score in datastore |
59
142
|:--|:--|
60
-
|`actor`|`actors`|
61
-
|`id`|`id`|
62
-
|`indicator`|`indicator`|
63
-
|`kill_chain_phases`|`killChain`|
64
-
|`labels.ThreatType`|`threatType`|
65
-
|`last_updated`|`updated`|
66
-
|`malicious_confidence`|`confidence` (normalized to the 0-100 scale) |
67
-
|`published_date`|`validFrom` and `imported`|
68
-
|`type`|`type`|
143
+
|`domain`|`50`|
144
+
|`ip`|`50`|
145
+
|`ip_address`|`50`|
146
+
|`ip_addresses`|`50`|
147
+
|`md5`|`75`|
148
+
|`sha1`|`75`|
149
+
|`sha256`|`75`|
150
+
|`sha512`|`75`|
151
+
|`url`|`50` for phishing events, and `100` for disruption events |
152
+
153
+
### Type mapping for ZeroFox
69
154
155
+
The `type` object is mapped to the following normalized type values:
156
+
157
+
| Original type | Normalized type in the datastore |
0 commit comments