You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/IntelOwl/usage.md
+26-7Lines changed: 26 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -282,6 +282,17 @@ Some analyzers require details other than just IP, URL, Domain, etc. We classifi
282
282
283
283
[Some analyzers are optional](https://intelowlproject.github.io/docs/IntelOwl/advanced_usage/#optional-analyzers) and need to be enabled explicitly.
284
284
285
+
#### Creating Analyzers from the GUI
286
+
287
+
Sometimes, it's enough to provide a URL and a way to authenticate, like an API key, to connect to the service you want to integrate. If the service provides results in JSON format, you will get it in the report. There's no need to write python code for these cases, you need to leverage the "Create analyzer" button that you can find on the top right of the Analyzers table Page.
288
+
289
+

290
+
291
+
The form will open with the fields to fill in to create the analyzer.
292
+
293
+

294
+
295
+
285
296
### Connectors
286
297
287
298
Connectors are designed to run after every successful analysis which makes them suitable for automated threat-sharing. They support integration with other SIEM/SOAR projects, specifically aimed at Threat Sharing Platforms.
@@ -319,12 +330,12 @@ You can build your own custom Pivot with your custom logic with just few lines o
319
330
320
331
#### Creating Pivots from the GUI
321
332
322
-
From the GUI, the users can pivot in two ways:
333
+
From the GUI, the users can pivot in 3 ways:
323
334
324
-
- If a Job executed a [Visualizer](#visualizers), it is possible to select a field extracted and analyze its value by clicking the "Pivot" button (see following image). In this way, the user is able to "jump" from one indicator to another.
335
+
1. If a Job executed a [Visualizer](#visualizers), it is possible to select a field extracted and analyze its value by clicking the "Pivot" button (see following image). In this way, the user is able to "jump" from one indicator to another.
325
336

326
337
327
-
- Starting from an already existing [Investigation](#investigations-framework), it is possible to select a Job block and click the "Pivot" button to analyze the same observable again, usually choosing another [Playbook](#playbooks) (see following image)
338
+
2. Starting from an already existing [Investigation](#investigations-framework), it is possible to select a Job block and click the "Pivot" button to analyze the same observable again, usually choosing another [Playbook](#playbooks) (see following image)
In both cases, the user is redirected to the Scan Page that is precompiled with the observable selected. Then the user would be able to select the [Playbook](#playbooks) to execute in the new job.
@@ -339,6 +350,11 @@ In the following image you can find an example of an [Investigation](#investigat
339
350
340
351

341
352
353
+
3. If you want to create a pivot that will run automatically after certain conditions are triggered, you need to leverage the "Create pivot" button that you can find on the top right of the Pivots table Page.
354
+
This plugin can only run automatically within a playbook so it is important to select the analyzers or connectors required by your pivot.
355
+

356
+

357
+
342
358
### Visualizers
343
359
344
360
With IntelOwl v5 we introduced a new plugin type called **Visualizers**.
@@ -410,12 +426,15 @@ You can create new playbooks in different ways, based on the users you want to s
410
426
411
427
If you want to share them to every user in IntelOwl, create them via the Django Admin interface at `/admin/playbooks_manager/playbookconfig/`.
412
428
413
-
If you want share them to yourself or your organization only, you need to leverage the "Save as Playbook" button that you can find on the top right of the Job Result Page.
414
-
In this way, after you have done an analysis, you can save the configuration of the Plugins you executed for re-use with a single click.
429
+
If you want share them to yourself or your organization only, you have 2 options:
430
+
431
+
1. After you have done an analysis, you can save the configuration of the Plugins you executed for re-use with a single click. You need to leverage the "Save as Playbook" button that you can find on the top right of the Job Result Page.
432
+

415
433
416
-

434
+
2. If you want to create completely new playbooks, you need to leverage the "Create playbook" button that you can find on the top right of the Playbooks table Page. The form will open with the fields to fill in to create the playbook.
435
+

417
436
418
-
The created Playbook would be available to yourself only. If you want either to share it with your organization or to delete it, you need to go to the "Plugins" section and enable it manually by clicking the dedicated button.
437
+
In both cases, the created Playbook would be available to yourself only. If you want either to share it with your organization, to update it or to delete it, you need to go to the "Plugins" section and enable it manually by clicking the dedicated button.
0 commit comments