Skip to content

Commit 0f0b293

Browse files
committed
Update ZeroFox table
1 parent 3bfc7fc commit 0f0b293

File tree

1 file changed

+108
-52
lines changed

1 file changed

+108
-52
lines changed

docs/security/threat-intelligence/threat-intelligence-mapping.md

Lines changed: 108 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ The `type` object is mapped to the following normalized type values:
4040
| `binary_string` | `artifact:payload_bin` |
4141
| `bitcoin_address` | `url` |
4242
| `ip_address` | `ipv4-addr` / `ipv6-addr` |
43-
| `domain` | `domain-name` |
43+
| `domain` | `domain-name` |
4444
| `email_address` | `email-add` |
4545
| `file_path` | `file:name` |
4646
| `file_name` | `file:name` |
@@ -56,7 +56,7 @@ The `type` object is mapped to the following normalized type values:
5656

5757
## Intel 471
5858

59-
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition, Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
59+
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition | Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
6060

6161
Following are the normalized values for Intel 471:
6262

@@ -76,7 +76,7 @@ Following are the normalized values for Mandiant:
7676

7777
| Mandiant schema | Normalized schema in the datastore | Notes |
7878
|:--|:--|:--|
79-
| `[]actors` | `actors` | The JSON structure of individual actors are joined with a ", " |
79+
| `[]actors` | `actors` | The JSON structure of individual actors are joined with a " , " |
8080
| `id` | `id` | |
8181
| `threat_rating.confidence_score` | `confidence` | |
8282
| `unknown` | `threatType` | |
@@ -88,38 +88,110 @@ You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel So
8888

8989
Following are the normalized values for ZeroFox:
9090

91-
| ZeroFox schema | Normalized schema in the datastore | Notes |
92-
|:--|:--|:--|
93-
| `c2_domain` | `indicator` | |
94-
| `c2_ip_address` | `indicator` | |
95-
| `created_at` | `validFrom` | If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
96-
| `domain` | `indicator` | |
97-
| `domain-name--{{domain}}` | `id` | |
98-
| `file:hashes.'SHA-1'` | `type` | |
99-
| `file:hashes.'SHA-1'--{{sha1}}` | `id` | |
100-
| `file:hashes.'SHA-256'` | `type` | |
101-
| `file:hashes.'SHA-256'--{{sha256}}` | `id` | |
102-
| `file:hashes.'SHA-512'` | `type` | |
103-
| `file:hashes.'SHA-512'--{{sha512}}` | `id` | |
104-
| `file:hashes.MD5` | `type` | |
105-
| `file:hashes.'MD5'--{{md5}}` | `id` | |
106-
| `ip` | `indicator` | | |
107-
| `ip_address` | `indicator` | |
108-
| `ipv4-addr--{{c2_domain}}` | `id` | |
109-
| `ipv4-addr--{{c2_ip_address}}` | `id` | |
110-
| `ipv4-addr--{{ip_address}}` | `id` | |
111-
| `ipv6-addr--{{c2_ip_address}}` | `id` | |
112-
| `listed_at` | `validFrom` | |
113-
| `md5` | `indicator` | |
114-
| `scanned` | `validFrom` | |
115-
| `sha1` | `indicator` | |
116-
| `sha256` | `indicator` | |
117-
| `sha512` | `indicator` | |
118-
| `tags` | `confidence` | Set by default to `75`, but set to `25` if `c2_domain_top_1m` found as a tag. |
119-
| `updated_at` | `validFrom` | If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
120-
| `url` | `indicator` | |
121-
| `url--{{url}}` | `id` | |
122-
| *Not applicable* | `threatType` | All indicators are set to `compromised`. |
91+
| ZeroFox endpoint | ZeroFox schema | Normalized schema in the datastore | Notes |
92+
|:--|:--|:--|:--|
93+
| /botnet endpoint with `ip_address` populated | `ipv4-addr--<ip_address>` | `id` | Templated |
94+
| /botnet endpoint with `ip_address` populated | `ip_address` | `indicator` | |
95+
| /botnet endpoint with `ip_address` populated | | `type` | Statically set to `ip_address` |
96+
| /botnet endpoint with `ip_address` populated | | `threatType` | Statically set to `compromised` |
97+
| /botnet endpoint with `ip_address` populated | `listed_at` | `validFrom` | |
98+
| /botnet endpoint with `ip_address` populated | | `confidence` | Statically set to `50`
99+
| /botnet endpoint with `c2_ip_address` populated | `ipv4-addr--<c2_ip_address>` | `id` | Templated |
100+
| /botnet endpoint with `c2_ip_address` populated | `c2_ip_address` | `indicator` | |
101+
| /botnet endpoint with `c2_ip_address` populated | | `type` | Statically set to `ip_address` |
102+
| /botnet endpoint with `c2_ip_address` populated | | `threatType` | Statically set to `compromised` |
103+
| /botnet endpoint with `c2_ip_address` populated | `listed_at` | `validFrom` | |
104+
| /botnet endpoint with `c2_ip_address` populated | `tags` | `confidence` | Default statically set to `75, but set to 25 if `c2_domain_top_1m` found as a tag |
105+
| /botnet endpoint with `c2_domain` populated | `ipv4-addr--<c2_domain>` | `id` | Templated |
106+
| /botnet endpoint with `c2_domain` populated | `c2_domain` | `indicator` | |
107+
| /botnet endpoint with `c2_domain` populated | | `type` | Statically set to `domain-name` |
108+
| /botnet endpoint with `c2_domain` populated | | `threatType` | Statically set to `compromised` |
109+
| /botnet endpoint with `c2_domain` populated | `listed_at` | `validFrom` | |
110+
| /botnet endpoint with `c2_domain` populated | `tags` | `confidence` | Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
111+
| /c2-domains endpoint with `domain` populated | `domain-name--<domain>` | `id` | Templated |
112+
| /c2-domains endpoint with `domain` populated | `domain` | `indicator` | |
113+
| /c2-domains endpoint with `domain` populated | | `type` | Statically set to `domain-name` |
114+
| /c2-domains endpoint with `domain` populated | | `threatType` | Statically set to `compromised` |
115+
| /c2-domains endpoint with `domain` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
116+
| /c2-domains endpoint with `domain` populated | `tags` | `confidence` | Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
117+
| /c2-domains endpoint with each `Ip_addresses` populated | `ipv4-addr--<c2_ip_address>` or `ipv6-addr--<c2_ip_address>` | `id` | Templated. Depends if value is IPv4 or IPv6 |
118+
| /c2-domains endpoint with each `Ip_addresses` populated | `[]Ip_addresses` | `indicator` | The specific value in the list |
119+
| /c2-domains endpoint with each `Ip_addresses` populated | | `type` | Statically set to `ipv4-addr` or `ipv6-addr` |
120+
| /c2-domains endpoint with each `Ip_addresses` populated | | `threatType` | Statically set to `compromised` |
121+
| /c2-domains endpoint with each `Ip_addresses` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
122+
| /c2-domains endpoint with each `Ip_addresses` populated | | `confidence` | Statically set to `50` |
123+
| /disruption endpoint with `url` populated | `url--<url>` | `id` | Templated |
124+
| /disruption endpoint with `url` populated | `url` | `indicator` | |
125+
| /disruption endpoint with `url` populated | | `type` | Statically set to `url` |
126+
| /disruption endpoint with `url` populated | | `threatType` | Statically set to `compromised` |
127+
| /disruption endpoint with `url` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
128+
| /disruption endpoint with `url` populated | | `confidence` | Statically set to `100` |
129+
| /disruption endpoint with `ip` populated | `ipv4-addr--<ip>` | `id` | Templated |
130+
| /disruption endpoint with `ip` populated | `ip` | `indicator` | |
131+
| /disruption endpoint with `ip` populated | | `type` | Statically set to `ipv4-addr` |
132+
| /disruption endpoint with `ip` populated | | `threatType` | Statically set to `compromised` |
133+
| /disruption endpoint with `ip` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
134+
| /disruption endpoint with `ip` populated | | `confidence` | Statically set to `50` |
135+
| /malware endpoint with `md5` populated | `file:hashes.MD5--<md5>` | `id` | Templated |
136+
| /malware endpoint with `md5` populated | `md5` | `indicator` | |
137+
| /malware endpoint with `md5` populated | `file:hashes.MD5` | `type` | |
138+
| /malware endpoint with `md5` populated | | `threatType` | Statically set to `compromised` |
139+
| /malware endpoint with `md5` populated | `created_at` | `validFrom` | |
140+
| /malware endpoint with `md5` populated | | `confidence` | Statically set to `75` |
141+
| /malware endpoint with `sha1` populated | `file:hashes.'SHA-1'--<sha1>` | `id` | Templated |
142+
| /malware endpoint with `sha1` populated | `sha1` | `indicator` | |
143+
| /malware endpoint with `sha1` populated | `file:hashes.'SHA-1'` | `type` | |
144+
| /malware endpoint with `sha1` populated | | `threatType` | Statically set to `compromised` |
145+
| /malware endpoint with `sha1` populated | `created_at` | `validFrom` |
146+
| /malware endpoint with `sha1` populated | | `confidence` | Statically set to `75` |
147+
| /malware endpoint with `sha256` populated | `file:hashes.'SHA-256'--<sha256>` | `id` | Templated |
148+
| /malware endpoint with `sha256` populated | `sha256` | `indicator` | |
149+
| /malware endpoint with `sha256` populated | `file:hashes.'SHA-256'` | `type` | |
150+
| /malware endpoint with `sha256` populated | | `threatType` | Statically set to `compromised` |
151+
| /malware endpoint with `sha256` populated | `created_at` | `validFrom` | |
152+
| /malware endpoint with `sha256` populated | | `confidence` | Statically set to `75` |
153+
| /malware endpoint with `sha512` populated | `file:hashes.'SHA-512'--<sha512>` | `id` | Templated |
154+
| /malware endpoint with `sha512` populated | `sha512` | `indicator` | |
155+
| /malware endpoint with `sha512` populated | `file:hashes.'SHA-512'` | `type` | |
156+
| /malware endpoint with `sha512` populated | | `threatType` | Statically set to `compromised` |
157+
| /malware endpoint with `sha512` populated | `created_at` | `validFrom` | |
158+
| /malware endpoint with `sha512` populated | | `confidence` | Statically set to `75` |
159+
| /phishing endpoint with `domain` populated |` domain-name--<domain>` | `id` | Templated |
160+
| /phishing endpoint with `domain` populated | `domain` | `indicator` | |
161+
| /phishing endpoint with `domain` populated | | `type` | Statically set to `domain-name` |
162+
| /phishing endpoint with `domain` populated | | `threatType` | Statically set to `compromised` |
163+
| /phishing endpoint with `domain` populated | `scanned` | `validFrom` | |
164+
| /phishing endpoint with `domain` populated | | `confidence` | Statically set to `50` |
165+
| /phishing endpoint with `url` populated |` url--<domain>` | `id` | Templated |
166+
| /phishing endpoint with `url` populated | `url` | `indicator` | |
167+
| /phishing endpoint with `url` populated | | `type` | Statically set to `url` |
168+
| /phishing endpoint with `url` populated | | `threatType` | Statically set to `compromised` |
169+
| /phishing endpoint with `url` populated | `scanned` | `validFrom` | |
170+
| /phishing endpoint with `url` populated | | `confidence` | Statically set to `50` |
171+
| /ransomware endpoint with `md5` populated | `file:hashes.MD5--<md5>` | `id` | Templated |
172+
| /ransomware endpoint with `md5` populated | `md5` | `indicator` | |
173+
| /ransomware endpoint with `md5` populated | `file:hashes.MD5` | `type` | |
174+
| /ransomware endpoint with `md5` populated | | `threatType` | Statically set to `compromised` |
175+
| /ransomware endpoint with `md5` populated | `created_at` | `validFrom` | |
176+
| /ransomware endpoint with `md5` populated | | `confidence` | Statically set to `75` |
177+
| /ransomware endpoint with `sha1` populated | `file:hashes.'SHA-1'--<sha1>` | `id` | Templated |
178+
| /ransomware endpoint with `sha1` populated | `sha1` | `indicator` | |
179+
| /ransomware endpoint with `sha1` populated | `file:hashes.'SHA-1'` | `type` | |
180+
| /ransomware endpoint with `sha1` populated | | `threatType` | Statically set to `compromised` |
181+
| /ransomware endpoint with `sha1` populated | `created_at` | `validFrom` | |
182+
| /ransomware endpoint with `sha1` populated | | `confidence` | Statically set to `75` |
183+
| /ransomware endpoint with `sha256` populated | `file:hashes.'SHA-256'--<sha256>` | `id` | Templated |
184+
| /ransomware endpoint with `sha256` populated | `sha256` | `indicator` | |
185+
| /ransomware endpoint with `sha256` populated | `file:hashes.'SHA-256'` | `type` | |
186+
| /ransomware endpoint with `sha256` populated | | `threatType` | Statically set to `compromised` |
187+
| /ransomware endpoint with `sha256` populated | `created_at` | `validFrom` | |
188+
| /ransomware endpoint with `sha256` populated | | `confidence` | Statically set to `75` |
189+
| /ransomware endpoint with `sha512` populated | `file:hashes.'SHA-512'--<sha512>` | `id` | Templated |
190+
| /ransomware endpoint with `sha512` populated | `sha512` | `indicator` | |
191+
| /ransomware endpoint with `sha512` populated | `file:hashes.'SHA-512'` | `type` | |
192+
| /ransomware endpoint with `sha512` populated | | `threatType` | Statically set to `compromised` |
193+
| /ransomware endpoint with `sha512` populated | `created_at` | `validFrom` | |
194+
| /ransomware endpoint with `sha512` populated | | `confidence` | Statically set to `75` |
123195

124196
### Type mapping for ZeroFox
125197

@@ -133,20 +205,4 @@ The `type` object is mapped to the following normalized type values:
133205
| `ip` | `ipv4-addr` |
134206
| `ip_address` | `ip_address` |
135207
| `Ip_addresses` | `ipv4-addr` or `ipv6-addr` |
136-
| `url` | `url` |
137-
138-
### Confidence mapping for ZeroFox
139-
140-
The `confidence` field in the datastore has the following values for ZeroFox:
141-
142-
| ZeroFox item | Confidence score in datastore |
143-
|:--|:--|
144-
| `domain` | `50` |
145-
| `ip` | `50` |
146-
| `ip_address` | `50` |
147-
| `ip_addresses` | `50` |
148-
| `md5` | `75` |
149-
| `sha1` | `75` |
150-
| `sha256` | `75` |
151-
| `sha512` | `75` |
152-
| `url` | `50` for phishing events, and `100` for disruption events |
208+
| `url` | `url` |

0 commit comments

Comments
 (0)