You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -40,7 +40,7 @@ The `type` object is mapped to the following normalized type values:
40
40
|`binary_string`|`artifact:payload_bin`|
41
41
|`bitcoin_address`|`url`|
42
42
|`ip_address`|`ipv4-addr` / `ipv6-addr`|
43
-
|`domain`|`domain-name`|
43
+
|`domain`|`domain-name`|
44
44
|`email_address`|`email-add`|
45
45
|`file_path`|`file:name`|
46
46
|`file_name`|`file:name`|
@@ -56,7 +56,7 @@ The `type` object is mapped to the following normalized type values:
56
56
57
57
## Intel 471
58
58
59
-
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition, Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
59
+
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition | Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
60
60
61
61
Following are the normalized values for Intel 471:
62
62
@@ -76,7 +76,7 @@ Following are the normalized values for Mandiant:
76
76
77
77
| Mandiant schema | Normalized schema in the datastore | Notes |
78
78
|:--|:--|:--|
79
-
|`[]actors`|`actors`| The JSON structure of individual actors are joined with a ", " |
79
+
|`[]actors`|`actors`| The JSON structure of individual actors are joined with a ", " |
80
80
|`id`|`id`||
81
81
|`threat_rating.confidence_score`|`confidence`||
82
82
|`unknown`|`threatType`||
@@ -88,38 +88,110 @@ You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel So
88
88
89
89
Following are the normalized values for ZeroFox:
90
90
91
-
| ZeroFox schema | Normalized schema in the datastore | Notes |
92
-
|:--|:--|:--|
93
-
|`c2_domain`|`indicator`||
94
-
|`c2_ip_address`|`indicator`||
95
-
|`created_at`|`validFrom`| If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
96
-
|`domain`|`indicator`||
97
-
|`domain-name--{{domain}}`|`id`||
98
-
|`file:hashes.'SHA-1'`|`type`||
99
-
|`file:hashes.'SHA-1'--{{sha1}}`|`id`||
100
-
|`file:hashes.'SHA-256'`|`type`||
101
-
|`file:hashes.'SHA-256'--{{sha256}}`|`id`||
102
-
|`file:hashes.'SHA-512'`|`type`||
103
-
|`file:hashes.'SHA-512'--{{sha512}}`|`id`||
104
-
|`file:hashes.MD5`|`type`||
105
-
|`file:hashes.'MD5'--{{md5}}`|`id`||
106
-
|`ip`|`indicator`|||
107
-
|`ip_address`|`indicator`||
108
-
|`ipv4-addr--{{c2_domain}}`|`id`||
109
-
|`ipv4-addr--{{c2_ip_address}}`|`id`||
110
-
|`ipv4-addr--{{ip_address}}`|`id`||
111
-
|`ipv6-addr--{{c2_ip_address}}`|`id`||
112
-
|`listed_at`|`validFrom`||
113
-
|`md5`|`indicator`||
114
-
|`scanned`|`validFrom`||
115
-
|`sha1`|`indicator`||
116
-
|`sha256`|`indicator`||
117
-
|`sha512`|`indicator`||
118
-
|`tags`|`confidence`| Set by default to `75`, but set to `25` if `c2_domain_top_1m` found as a tag. |
119
-
|`updated_at`|`validFrom`| If `created_at` and `updated_at` appear on the same item, use the latest for the `validFrom` value. |
120
-
|`url`|`indicator`||
121
-
|`url--{{url}}`|`id`||
122
-
|*Not applicable*|`threatType`| All indicators are set to `compromised`. |
91
+
| ZeroFox endpoint | ZeroFox schema | Normalized schema in the datastore | Notes |
92
+
|:--|:--|:--|:--|
93
+
| /botnet endpoint with `ip_address` populated |`ipv4-addr--<ip_address>`|`id`| Templated |
94
+
| /botnet endpoint with `ip_address` populated |`ip_address`|`indicator`||
95
+
| /botnet endpoint with `ip_address` populated ||`type`| Statically set to `ip_address`|
96
+
| /botnet endpoint with `ip_address` populated ||`threatType`| Statically set to `compromised`|
97
+
| /botnet endpoint with `ip_address` populated |`listed_at`|`validFrom`||
98
+
| /botnet endpoint with `ip_address` populated | | `confidence` | Statically set to `50`
99
+
| /botnet endpoint with `c2_ip_address` populated |`ipv4-addr--<c2_ip_address>`|`id`| Templated |
100
+
| /botnet endpoint with `c2_ip_address` populated |`c2_ip_address`|`indicator`||
101
+
| /botnet endpoint with `c2_ip_address` populated ||`type`| Statically set to `ip_address`|
102
+
| /botnet endpoint with `c2_ip_address` populated ||`threatType`| Statically set to `compromised`|
103
+
| /botnet endpoint with `c2_ip_address` populated |`listed_at`|`validFrom`||
104
+
| /botnet endpoint with `c2_ip_address` populated |`tags`|`confidence`| Default statically set to `75, but set to 25 if `c2_domain_top_1m` found as a tag |
105
+
| /botnet endpoint with `c2_domain` populated |`ipv4-addr--<c2_domain>`|`id`| Templated |
106
+
| /botnet endpoint with `c2_domain` populated |`c2_domain`|`indicator`||
107
+
| /botnet endpoint with `c2_domain` populated ||`type`| Statically set to `domain-name`|
108
+
| /botnet endpoint with `c2_domain` populated ||`threatType`| Statically set to `compromised`|
109
+
| /botnet endpoint with `c2_domain` populated |`listed_at`|`validFrom`||
110
+
| /botnet endpoint with `c2_domain` populated |`tags`|`confidence`| Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
111
+
| /c2-domains endpoint with `domain` populated |`domain-name--<domain>`|`id`| Templated |
112
+
| /c2-domains endpoint with `domain` populated |`domain`|`indicator`||
113
+
| /c2-domains endpoint with `domain` populated ||`type`| Statically set to `domain-name`|
114
+
| /c2-domains endpoint with `domain` populated ||`threatType`| Statically set to `compromised`|
115
+
| /c2-domains endpoint with `domain` populated |`created_at` or `updated_at`|`validFrom`| Use the latest of the two |
116
+
| /c2-domains endpoint with `domain` populated |`tags`|`confidence`| Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
117
+
| /c2-domains endpoint with each `Ip_addresses` populated |`ipv4-addr--<c2_ip_address>` or `ipv6-addr--<c2_ip_address>`|`id`| Templated. Depends if value is IPv4 or IPv6 |
118
+
| /c2-domains endpoint with each `Ip_addresses` populated |`[]Ip_addresses`|`indicator`| The specific value in the list |
119
+
| /c2-domains endpoint with each `Ip_addresses` populated ||`type`| Statically set to `ipv4-addr` or `ipv6-addr`|
120
+
| /c2-domains endpoint with each `Ip_addresses` populated ||`threatType`| Statically set to `compromised`|
121
+
| /c2-domains endpoint with each `Ip_addresses` populated |`created_at` or `updated_at`|`validFrom`| Use the latest of the two |
122
+
| /c2-domains endpoint with each `Ip_addresses` populated ||`confidence`| Statically set to `50`|
123
+
| /disruption endpoint with `url` populated |`url--<url>`|`id`| Templated |
124
+
| /disruption endpoint with `url` populated |`url`|`indicator`||
125
+
| /disruption endpoint with `url` populated ||`type`| Statically set to `url`|
126
+
| /disruption endpoint with `url` populated ||`threatType`| Statically set to `compromised`|
127
+
| /disruption endpoint with `url` populated |`created_at` or `updated_at`|`validFrom`| Use the latest of the two |
128
+
| /disruption endpoint with `url` populated ||`confidence`| Statically set to `100`|
129
+
| /disruption endpoint with `ip` populated |`ipv4-addr--<ip>`|`id`| Templated |
130
+
| /disruption endpoint with `ip` populated |`ip`|`indicator`||
131
+
| /disruption endpoint with `ip` populated ||`type`| Statically set to `ipv4-addr`|
132
+
| /disruption endpoint with `ip` populated ||`threatType`| Statically set to `compromised`|
133
+
| /disruption endpoint with `ip` populated |`created_at` or `updated_at`|`validFrom`| Use the latest of the two |
134
+
| /disruption endpoint with `ip` populated ||`confidence`| Statically set to `50`|
135
+
| /malware endpoint with `md5` populated |`file:hashes.MD5--<md5>`|`id`| Templated |
136
+
| /malware endpoint with `md5` populated |`md5`|`indicator`||
137
+
| /malware endpoint with `md5` populated |`file:hashes.MD5`|`type`||
138
+
| /malware endpoint with `md5` populated ||`threatType`| Statically set to `compromised`|
139
+
| /malware endpoint with `md5` populated |`created_at`|`validFrom`||
140
+
| /malware endpoint with `md5` populated ||`confidence`| Statically set to `75`|
141
+
| /malware endpoint with `sha1` populated |`file:hashes.'SHA-1'--<sha1>`|`id`| Templated |
142
+
| /malware endpoint with `sha1` populated |`sha1`|`indicator`||
143
+
| /malware endpoint with `sha1` populated |`file:hashes.'SHA-1'`|`type`||
144
+
| /malware endpoint with `sha1` populated ||`threatType`| Statically set to `compromised`|
145
+
| /malware endpoint with `sha1` populated |`created_at`|`validFrom`|
146
+
| /malware endpoint with `sha1` populated ||`confidence`| Statically set to `75`|
147
+
| /malware endpoint with `sha256` populated |`file:hashes.'SHA-256'--<sha256>`|`id`| Templated |
148
+
| /malware endpoint with `sha256` populated |`sha256`|`indicator`||
149
+
| /malware endpoint with `sha256` populated |`file:hashes.'SHA-256'`|`type`||
150
+
| /malware endpoint with `sha256` populated ||`threatType`| Statically set to `compromised`|
151
+
| /malware endpoint with `sha256` populated |`created_at`|`validFrom`||
152
+
| /malware endpoint with `sha256` populated ||`confidence`| Statically set to `75`|
153
+
| /malware endpoint with `sha512` populated |`file:hashes.'SHA-512'--<sha512>`|`id`| Templated |
154
+
| /malware endpoint with `sha512` populated |`sha512`|`indicator`||
155
+
| /malware endpoint with `sha512` populated |`file:hashes.'SHA-512'`|`type`||
156
+
| /malware endpoint with `sha512` populated ||`threatType`| Statically set to `compromised`|
157
+
| /malware endpoint with `sha512` populated |`created_at`|`validFrom`||
158
+
| /malware endpoint with `sha512` populated ||`confidence`| Statically set to `75`|
159
+
| /phishing endpoint with `domain` populated |` domain-name--<domain>`|`id`| Templated |
160
+
| /phishing endpoint with `domain` populated |`domain`|`indicator`||
161
+
| /phishing endpoint with `domain` populated ||`type`| Statically set to `domain-name`|
162
+
| /phishing endpoint with `domain` populated ||`threatType`| Statically set to `compromised`|
163
+
| /phishing endpoint with `domain` populated |`scanned`|`validFrom`||
164
+
| /phishing endpoint with `domain` populated ||`confidence`| Statically set to `50`|
165
+
| /phishing endpoint with `url` populated |` url--<domain>`|`id`| Templated |
166
+
| /phishing endpoint with `url` populated |`url`|`indicator`||
167
+
| /phishing endpoint with `url` populated ||`type`| Statically set to `url`|
168
+
| /phishing endpoint with `url` populated ||`threatType`| Statically set to `compromised`|
169
+
| /phishing endpoint with `url` populated |`scanned`|`validFrom`||
170
+
| /phishing endpoint with `url` populated ||`confidence`| Statically set to `50`|
171
+
| /ransomware endpoint with `md5` populated |`file:hashes.MD5--<md5>`|`id`| Templated |
172
+
| /ransomware endpoint with `md5` populated |`md5`|`indicator`||
173
+
| /ransomware endpoint with `md5` populated |`file:hashes.MD5`|`type`||
174
+
| /ransomware endpoint with `md5` populated ||`threatType`| Statically set to `compromised`|
175
+
| /ransomware endpoint with `md5` populated |`created_at`|`validFrom`||
176
+
| /ransomware endpoint with `md5` populated ||`confidence`| Statically set to `75`|
177
+
| /ransomware endpoint with `sha1` populated |`file:hashes.'SHA-1'--<sha1>`|`id`| Templated |
178
+
| /ransomware endpoint with `sha1` populated |`sha1`|`indicator`||
179
+
| /ransomware endpoint with `sha1` populated |`file:hashes.'SHA-1'`|`type`||
180
+
| /ransomware endpoint with `sha1` populated ||`threatType`| Statically set to `compromised`|
181
+
| /ransomware endpoint with `sha1` populated |`created_at`|`validFrom`||
182
+
| /ransomware endpoint with `sha1` populated ||`confidence`| Statically set to `75`|
183
+
| /ransomware endpoint with `sha256` populated |`file:hashes.'SHA-256'--<sha256>`|`id`| Templated |
184
+
| /ransomware endpoint with `sha256` populated |`sha256`|`indicator`||
185
+
| /ransomware endpoint with `sha256` populated |`file:hashes.'SHA-256'`|`type`||
186
+
| /ransomware endpoint with `sha256` populated ||`threatType`| Statically set to `compromised`|
187
+
| /ransomware endpoint with `sha256` populated |`created_at`|`validFrom`||
188
+
| /ransomware endpoint with `sha256` populated ||`confidence`| Statically set to `75`|
189
+
| /ransomware endpoint with `sha512` populated |`file:hashes.'SHA-512'--<sha512>`|`id`| Templated |
190
+
| /ransomware endpoint with `sha512` populated |`sha512`|`indicator`||
191
+
| /ransomware endpoint with `sha512` populated |`file:hashes.'SHA-512'`|`type`||
192
+
| /ransomware endpoint with `sha512` populated ||`threatType`| Statically set to `compromised`|
193
+
| /ransomware endpoint with `sha512` populated |`created_at`|`validFrom`||
194
+
| /ransomware endpoint with `sha512` populated ||`confidence`| Statically set to `75`|
123
195
124
196
### Type mapping for ZeroFox
125
197
@@ -133,20 +205,4 @@ The `type` object is mapped to the following normalized type values:
133
205
|`ip`|`ipv4-addr`|
134
206
|`ip_address`|`ip_address`|
135
207
|`Ip_addresses`|`ipv4-addr` or `ipv6-addr`|
136
-
|`url`|`url`|
137
-
138
-
### Confidence mapping for ZeroFox
139
-
140
-
The `confidence` field in the datastore has the following values for ZeroFox:
141
-
142
-
| ZeroFox item | Confidence score in datastore |
143
-
|:--|:--|
144
-
|`domain`|`50`|
145
-
|`ip`|`50`|
146
-
|`ip_address`|`50`|
147
-
|`ip_addresses`|`50`|
148
-
|`md5`|`75`|
149
-
|`sha1`|`75`|
150
-
|`sha256`|`75`|
151
-
|`sha512`|`75`|
152
-
|`url`|`50` for phishing events, and `100` for disruption events |
0 commit comments