Skip to content

Commit e5e9ba1

Browse files
Creating analyzers, playbooks and pivots from the gui (#15)
* plugin creation from the gui * changes
1 parent b839463 commit e5e9ba1

File tree

6 files changed

+26
-7
lines changed

6 files changed

+26
-7
lines changed
257 KB
Loading
6.91 KB
Loading
6.44 KB
Loading
193 KB
Loading
174 KB
Loading

docs/IntelOwl/usage.md

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,17 @@ Some analyzers require details other than just IP, URL, Domain, etc. We classifi
282282

283283
[Some analyzers are optional](https://intelowlproject.github.io/docs/IntelOwl/advanced_usage/#optional-analyzers) and need to be enabled explicitly.
284284

285+
#### Creating Analyzers from the GUI
286+
287+
Sometimes, it's enough to provide a URL and a way to authenticate, like an API key, to connect to the service you want to integrate. If the service provides results in JSON format, you will get it in the report. There's no need to write python code for these cases, you need to leverage the "Create analyzer" button that you can find on the top right of the Analyzers table Page.
288+
289+
![img.png](./static/analyzer_creation_btn.png)
290+
291+
The form will open with the fields to fill in to create the analyzer.
292+
293+
![img.png](./static/analyzer_creation.png)
294+
295+
285296
### Connectors
286297

287298
Connectors are designed to run after every successful analysis which makes them suitable for automated threat-sharing. They support integration with other SIEM/SOAR projects, specifically aimed at Threat Sharing Platforms.
@@ -319,12 +330,12 @@ You can build your own custom Pivot with your custom logic with just few lines o
319330

320331
#### Creating Pivots from the GUI
321332

322-
From the GUI, the users can pivot in two ways:
333+
From the GUI, the users can pivot in 3 ways:
323334

324-
- If a Job executed a [Visualizer](#visualizers), it is possible to select a field extracted and analyze its value by clicking the "Pivot" button (see following image). In this way, the user is able to "jump" from one indicator to another.
335+
1. If a Job executed a [Visualizer](#visualizers), it is possible to select a field extracted and analyze its value by clicking the "Pivot" button (see following image). In this way, the user is able to "jump" from one indicator to another.
325336
![img.png](./static/pivot_job_report.png)
326337

327-
- Starting from an already existing [Investigation](#investigations-framework), it is possible to select a Job block and click the "Pivot" button to analyze the same observable again, usually choosing another [Playbook](#playbooks) (see following image)
338+
2. Starting from an already existing [Investigation](#investigations-framework), it is possible to select a Job block and click the "Pivot" button to analyze the same observable again, usually choosing another [Playbook](#playbooks) (see following image)
328339
![img.png](./static/pivot_investigation_report.png)
329340

330341
In both cases, the user is redirected to the Scan Page that is precompiled with the observable selected. Then the user would be able to select the [Playbook](#playbooks) to execute in the new job.
@@ -339,6 +350,11 @@ In the following image you can find an example of an [Investigation](#investigat
339350

340351
![img.png](./static/pivot_investigation.png)
341352

353+
3. If you want to create a pivot that will run automatically after certain conditions are triggered, you need to leverage the "Create pivot" button that you can find on the top right of the Pivots table Page.
354+
This plugin can only run automatically within a playbook so it is important to select the analyzers or connectors required by your pivot.
355+
![img.png](./static/pivot_creation_btn.png)
356+
![img.png](./static/pivot_creation_form.png)
357+
342358
### Visualizers
343359

344360
With IntelOwl v5 we introduced a new plugin type called **Visualizers**.
@@ -410,12 +426,15 @@ You can create new playbooks in different ways, based on the users you want to s
410426

411427
If you want to share them to every user in IntelOwl, create them via the Django Admin interface at `/admin/playbooks_manager/playbookconfig/`.
412428

413-
If you want share them to yourself or your organization only, you need to leverage the "Save as Playbook" button that you can find on the top right of the Job Result Page.
414-
In this way, after you have done an analysis, you can save the configuration of the Plugins you executed for re-use with a single click.
429+
If you want share them to yourself or your organization only, you have 2 options:
430+
431+
1. After you have done an analysis, you can save the configuration of the Plugins you executed for re-use with a single click. You need to leverage the "Save as Playbook" button that you can find on the top right of the Job Result Page.
432+
![img.png](./static/playbook_creation.png)
415433

416-
![img.png](./static/playbook_creation.png)
434+
2. If you want to create completely new playbooks, you need to leverage the "Create playbook" button that you can find on the top right of the Playbooks table Page. The form will open with the fields to fill in to create the playbook.
435+
![img.png](./static/playbook_creation_form.png)
417436

418-
The created Playbook would be available to yourself only. If you want either to share it with your organization or to delete it, you need to go to the "Plugins" section and enable it manually by clicking the dedicated button.
437+
In both cases, the created Playbook would be available to yourself only. If you want either to share it with your organization, to update it or to delete it, you need to go to the "Plugins" section and enable it manually by clicking the dedicated button.
419438

420439
![img.png](./static/playbooks_cr.png)
421440

0 commit comments

Comments
 (0)