Skip to content

Commit 9a64de6

Browse files
jpipkin1jpipkin1
committed
Cleanup
1 parent f2bc017 commit 9a64de6

File tree

2 files changed

+52
-61
lines changed

2 files changed

+52
-61
lines changed

‎docs/security/threat-intelligence/index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,10 @@ See the following articles to learn about Sumo Logic's threat intelligence capab
4242
<p>Learn how to format upload files containing threat intelligence indicators.</p>
4343
</div>
4444
</div>
45+
<div className="box smallbox card">
46+
<div className="container">
47+
<a href="/docs/security/threat-intelligence/threat-intelligence-mapping"><img src={useBaseUrl('img/icons/security/cloud-siem.png')} alt="icon" width="40"/><h4>Threat Intelligence Mapping</h4></a>
48+
<p>Learn about the mapping of threat intelligence schema from vendor sources to Sumo Logic schema.</p>
49+
</div>
50+
</div>
4551
</div>

‎docs/security/threat-intelligence/threat-intelligence-mapping.md‎

Lines changed: 46 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,41 @@
11
---
22
slug: /security/threat-intelligence/threat-intelligence-mapping
33
title: Threat Intelligence Mapping
4-
sidebar_label: Mapping
5-
description: Learn about mapping of threat intelligence indicators to Sumo Logic.
4+
sidebar_label: Mapping
5+
description: Learn about the mapping of threat intelligence schema from vendor sources to Sumo Logic schema.
66
---
77

88
import useBaseUrl from '@docusaurus/useBaseUrl';
99

10-
## _sumo_global_feed_cs mapping
10+
Schema from vendor-supplied threat intelligence indicators are mapped to normalized values in the Sumo Logic threat intelligence datastore to provide ease of interoperability. The mapping is described in this article.
1111

12-
Sumo Logic provides an out-of-the-box a `_sumo_global_feed_cs` source of threat intelligence indicators supplied by CrowdStrike. You can see it in the [**Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab). This source is a default source and cannot be changed or deleted.
12+
## CrowdStrike
1313

14-
In the threat intelligence datastore, the schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
14+
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source). In addition, Sumo Logic provides an out-of-the-box `_sumo_global_feed_cs` source whose indicators are supplied by CrowdStrike. The same normalization applies to schema in both sources.
1515

16-
| Original schema | Normalized schema in the datastore |
17-
|:--|:--|
18-
| `actor` | `actors` |
19-
| `id` | `id` |
20-
| `indicator` | `indicator` |
21-
| `kill_chain_phases` | `killChain` |
22-
| `labels.ThreatType` | `threatType` |
23-
| `last_updated` | `updated` |
24-
| `malicious_confidence` | `confidence` (normalized to the 0-100 scale) |
25-
| `published_date` | `validFrom` and `imported` |
26-
| `type` | `type` |
16+
Following are the normalized values for CrowdStrike:
17+
18+
| CrowdStrike schema | Normalized schema in the datastore | Notes |
19+
|:--|:--|:--|
20+
| `actor` | `actors` | Array joined with a comma: ", " |
21+
| `id` | `id` | Array joined with a comma: ", " |
22+
| `indicator` | `indicator` | |
23+
| `kill_chain_phases` | `killChain` | |
24+
| `labels.ThreatType` | `threatType`* | |
25+
| `last_updated` | `updated` | |
26+
| `malicious_confidence` | `confidence` | Normalized to a 0-100 scale. |
27+
| `published_date` | `validFrom` and `imported` | |
28+
| `type` | `type` | |
29+
30+
All other fields will be kept in the `fields{}` object.
2731

28-
(All other fields will be kept in the `fields{}` object.)
32+
*The value `malicious-activity` is used for the `threatType` if the regex matches: `name=threattype\/(clickfraud|commodity|pointofsale|randomware|targeted|targetedcrimeware)`. The value `anomalous-activity` is used if the regex matches `name=threattype\/`, and the value `unknown` is used if nothing matches.
2933

30-
### Type mapping for _sumo_global_feed_cs
34+
### Type mapping for CrowdStrike
3135

3236
The `type` object is mapped to the following normalized type values:
3337

34-
| Original type | Normalized type in the datastore |
38+
| Original type in CrowdStrike | Normalized type in the datastore |
3539
|:--|:--|
3640
| `binary_string` | `artifact:payload_bin` |
3741
| `bitcoin_address` | `url` |
@@ -50,42 +54,25 @@ The `type` object is mapped to the following normalized type values:
5054
| `user_agent` | `http-request-ext:request_header.'User-Agent'` |
5155
| `x509_subject` | `x509-certificate:serial_number` |
5256

57+
## Intel 471
5358

54-
## CrowdStrike mapping
55-
56-
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source).
59+
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition, Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
5760

58-
In the threat intelligence datastore, the CrowdStrike schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
61+
Following are the normalized values for Intel 471:
5962

60-
| CrowdStrike schema | Normalized schema in the datastore | Notes |
61-
|:--|:--|:--|
62-
| `[]actors` | `actors` | Array joined with a ", " |
63-
| `id` | `id` | Array joined with a ", " |
64-
| `indicator` | `indicator` | |
65-
| `[]kill_chains` | `killChain` | |
66-
| `labels` | `threatType` | Value used can also be `malicious-activity`, `anomalous-activity`, or `unknown`.* |
67-
68-
*Value `malicious-activity` used if regex matches: `name=threattype\/(clickfraud|commodity|pointofsale|randomware|targeted|targetedcrimeware)` <br/>Value `anomalous-activity` used if regex matches: `name=threattype\/` <br/>Value `unknown` used if nothing matches.
69-
70-
## Intel471 mapping
71-
72-
You can ingest threat indicators from Intel471 using the [Intel471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/).
73-
74-
In the threat intelligence datastore, the Intel471 schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
75-
76-
| ThreatIntel 471 schema | Normalized schema in the datastore | Notes |
63+
| Intel 471 schema | Normalized schema in the datastore | Notes |
7764
|:--|:--|:--|
7865
| `activity.last` | `validFrom` | Converted from epoch timestamp. |
7966
| `data.expiration` | `validUntil` | Converted from epoch timestamp. |
8067
| `data.mitre_tactics` | `killChain` | |
8168
| `data.threat.uid` | `id` | |
8269
| | `threatType` | Statically set to `unknown`. |
8370

84-
## Mandiant mapping
71+
## Mandiant
8572

8673
You can ingest threat indicators from Mandiant using the [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source/).
8774

88-
In the threat intelligence datastore, the Mandiant schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
75+
Following are the normalized values for Mandiant:
8976

9077
| Mandiant schema | Normalized schema in the datastore | Notes |
9178
|:--|:--|:--|
@@ -95,13 +82,13 @@ In the threat intelligence datastore, the Mandiant schema is mapped to normalize
9582
| `unknown` | `threatType` | |
9683
| `value` | `indicator` | |
9784

98-
## ZeroFox mapping
85+
## ZeroFox
9986

10087
You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zerofox-intel-source/).
10188

102-
In the threat intelligence datastore, the ZeroFox schema is mapped to normalized values to provide ease of interoperability with the schema from other threat intelligence sources:
89+
Following are the normalized values for ZeroFox:
10390

104-
| Mandiant schema | Normalized schema in the datastore | Notes |
91+
| ZeroFox schema | Normalized schema in the datastore | Notes |
10592
|:--|:--|:--|
10693
| `c2_domain` | `indicator` | |
10794
| `c2_ip_address` | `indicator` | |
@@ -134,22 +121,6 @@ In the threat intelligence datastore, the ZeroFox schema is mapped to normalized
134121
| `url--{{url}}` | `id` | |
135122
| | `threatType` | Set to `compromised`. |
136123

137-
### Confidence mapping for ZeroFox
138-
139-
The `confidence` field in the datastore has the following values for ZeroFox:
140-
141-
| ZeroFox item | Confidence score in datastore |
142-
|:--|:--|
143-
| `domain` | `50` |
144-
| `ip` | `50` |
145-
| `ip_address` | `50` |
146-
| `ip_addresses` | `50` |
147-
| `md5` | `75` |
148-
| `sha1` | `75` |
149-
| `sha256` | `75` |
150-
| `sha512` | `75` |
151-
| `url` | `50` for phishing events, and `100` for disruption events |
152-
153124
### Type mapping for ZeroFox
154125

155126
The `type` object is mapped to the following normalized type values:
@@ -164,4 +135,18 @@ The `type` object is mapped to the following normalized type values:
164135
| `Ip_addresses` | `ipv4-addr` or `ipv6-addr` |
165136
| `url` | `url` |
166137

138+
### Confidence mapping for ZeroFox
139+
140+
The `confidence` field in the datastore has the following values for ZeroFox:
167141

142+
| ZeroFox item | Confidence score in datastore |
143+
|:--|:--|
144+
| `domain` | `50` |
145+
| `ip` | `50` |
146+
| `ip_address` | `50` |
147+
| `ip_addresses` | `50` |
148+
| `md5` | `75` |
149+
| `sha1` | `75` |
150+
| `sha256` | `75` |
151+
| `sha512` | `75` |
152+
| `url` | `50` for phishing events, and `100` for disruption events |

0 commit comments

Comments
 (0)