Skip to content

Commit 163e202

Browse files
jpipkin1kimsauce
jpipkin1
and
kimsauce
authored
DOCS-629 - Threat intel mapping (#5583)
* Add back the mapping article * Add mapping * Fix build break * Cleanup * Final changes * Update docs/security/threat-intelligence/threat-intelligence-mapping.md Co-authored-by: Kim (Sumo Logic) <[email protected]> * Minor fix * Update ZeroFox table --------- Co-authored-by: Kim (Sumo Logic) <[email protected]>
1 parent 157fca5 commit 163e202

File tree

4 files changed

+215
-1
lines changed

4 files changed

+215
-1
lines changed

‎cid-redirects.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3366,7 +3366,6 @@
33663366
"/Manage/Security/Set-the-Password-Policy": "/docs/manage/security/set-password-policy",
33673367
"/Manage/Threat-Intel-Ingest": "/docs/security/threat-intelligence",
33683368
"/docs/platform-services/threat-intelligence-indicators": "/docs/security/threat-intelligence",
3369-
"/docs/security/threat-intelligence/threat-intelligence-mapping": "/docs/security/threat-intelligence",
33703369
"/docs/manage/users/manage-access-keys": "/docs/manage/security/access-keys",
33713370
"/Manage/Users-and-Roles": "/docs/manage/users-roles",
33723371
"/Manage/Users-and-Roles/Manage-Roles": "/docs/manage/users-roles",

‎docs/security/threat-intelligence/index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,10 @@ See the following articles to learn about Sumo Logic's threat intelligence capab
4242
<p>Learn how to format upload files containing threat intelligence indicators.</p>
4343
</div>
4444
</div>
45+
<div className="box smallbox card">
46+
<div className="container">
47+
<a href="/docs/security/threat-intelligence/threat-intelligence-mapping"><img src={useBaseUrl('img/icons/security/cloud-siem.png')} alt="icon" width="40"/><h4>Threat Intelligence Mapping</h4></a>
48+
<p>Learn about the mapping of threat intelligence schema from vendor sources to Sumo Logic schema.</p>
49+
</div>
50+
</div>
4551
</div>

‎docs/security/threat-intelligence/threat-intelligence-mapping.md

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
---
2+
id: threat-intelligence-mapping
3+
title: Threat Intelligence Mapping
4+
sidebar_label: Mapping
5+
description: Learn about the mapping of threat intelligence schema from vendor sources to Sumo Logic schema.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
10+
Schema from vendor-supplied threat intelligence indicators are mapped to [normalized values](/docs/security/threat-intelligence/upload-formats/#normalized-json-format) in the Sumo Logic threat intelligence datastore to provide ease of interoperability. The mapping is described in this article.
11+
12+
## CrowdStrike
13+
14+
You can ingest threat indicators from CrowdStrike using the [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source). In addition, Sumo Logic provides an out-of-the-box `_sumo_global_feed_cs` source whose indicators are supplied by CrowdStrike. The same normalization applies to schema in both sources.
15+
16+
Following are the normalized values for CrowdStrike:
17+
18+
| CrowdStrike schema | Normalized schema in the datastore | Notes |
19+
|:--|:--|:--|
20+
| `actor` | `actors` | Array joined with a comma: ", " |
21+
| `id` | `id` | Array joined with a comma: ", " |
22+
| `indicator` | `indicator` | |
23+
| `kill_chain_phases` | `killChain` | |
24+
| `labels.ThreatType` | `threatType`* | The `threatType` value can vary based on matches*. |
25+
| `last_updated` | `updated` | |
26+
| `malicious_confidence` | `confidence` | Normalized to a 0-100 scale. |
27+
| `published_date` | `validFrom` and `imported` | |
28+
| `type` | `type` | See [Type mapping for CrowdStrike](/docs/security/threat-intelligence/threat-intelligence-mapping/#type-mapping-for-crowdstrike) below. |
29+
30+
All other fields will be kept in the `fields{}` object.
31+
32+
*The value `malicious-activity` is used for the `threatType` if the regex matches: `name=threattype\/(clickfraud|commodity|pointofsale|ransomware|targeted|targetedcrimeware)`. The value `anomalous-activity` is used if the regex matches `name=threattype\/`, and the value `unknown` is used if nothing matches.
33+
34+
### Type mapping for CrowdStrike
35+
36+
The `type` object is mapped to the following normalized type values:
37+
38+
| Original type in CrowdStrike | Normalized type in the datastore |
39+
|:--|:--|
40+
| `binary_string` | `artifact:payload_bin` |
41+
| `bitcoin_address` | `url` |
42+
| `ip_address` | `ipv4-addr` / `ipv6-addr` |
43+
| `domain` | `domain-name` |
44+
| `email_address` | `email-add` |
45+
| `file_path` | `file:name` |
46+
| `file_name` | `file:name` |
47+
| `hash_md5` | `file:hashes.'MD5'` |
48+
| `hash_sha1` | `file:hashes.'SHA-1'` |
49+
| `hash_sha256` | `file:hashes.'SHA-256'` |
50+
| `mutex_name` | `mutex:name` |
51+
| `service_name` | `process:name` |
52+
| `url` | `url` |
53+
| `username` | `user-account:user_id` |
54+
| `user_agent` | `http-request-ext:request_header.'User-Agent'` |
55+
| `x509_subject` | `x509-certificate:serial_number` |
56+
57+
## Intel 471
58+
59+
You can ingest threat indicators from Intel 471 using the [Intel 471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source/). In addition | Sumo Logic provides an out-of-the-box `SumoLogic_ThreatIntel` source whose indicators are supplied by Intel 471. The same normalization applies to schema in both sources.
60+
61+
Following are the normalized values for Intel 471:
62+
63+
| Intel 471 schema | Normalized schema in the datastore | Notes |
64+
|:--|:--|:--|
65+
| `activity.last` | `validFrom` | Converted from epoch timestamp. |
66+
| `data.expiration` | `validUntil` | Converted from epoch timestamp. |
67+
| `data.mitre_tactics` | `killChain` | |
68+
| `data.threat.uid` | `id` | |
69+
| *Not applicable* | `threatType` | All indicators have `threatType` set to `unknown`. |
70+
71+
## Mandiant
72+
73+
You can ingest threat indicators from Mandiant using the [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source/).
74+
75+
Following are the normalized values for Mandiant:
76+
77+
| Mandiant schema | Normalized schema in the datastore | Notes |
78+
|:--|:--|:--|
79+
| `[]actors` | `actors` | The JSON structure of individual actors are joined with a " , " |
80+
| `id` | `id` | |
81+
| `threat_rating.confidence_score` | `confidence` | |
82+
| `unknown` | `threatType` | |
83+
| `value` | `indicator` | |
84+
85+
## ZeroFox
86+
87+
You can ingest threat indicators from ZeroFox using the [ZeroFox Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zerofox-intel-source/).
88+
89+
Following are the normalized values for ZeroFox:
90+
91+
| ZeroFox endpoint | ZeroFox schema | Normalized schema in the datastore | Notes |
92+
|:--|:--|:--|:--|
93+
| /botnet endpoint with `ip_address` populated | `ipv4-addr--<ip_address>` | `id` | Templated |
94+
| /botnet endpoint with `ip_address` populated | `ip_address` | `indicator` | |
95+
| /botnet endpoint with `ip_address` populated | | `type` | Statically set to `ip_address` |
96+
| /botnet endpoint with `ip_address` populated | | `threatType` | Statically set to `compromised` |
97+
| /botnet endpoint with `ip_address` populated | `listed_at` | `validFrom` | |
98+
| /botnet endpoint with `ip_address` populated | | `confidence` | Statically set to `50`
99+
| /botnet endpoint with `c2_ip_address` populated | `ipv4-addr--<c2_ip_address>` | `id` | Templated |
100+
| /botnet endpoint with `c2_ip_address` populated | `c2_ip_address` | `indicator` | |
101+
| /botnet endpoint with `c2_ip_address` populated | | `type` | Statically set to `ip_address` |
102+
| /botnet endpoint with `c2_ip_address` populated | | `threatType` | Statically set to `compromised` |
103+
| /botnet endpoint with `c2_ip_address` populated | `listed_at` | `validFrom` | |
104+
| /botnet endpoint with `c2_ip_address` populated | `tags` | `confidence` | Default statically set to `75, but set to 25 if `c2_domain_top_1m` found as a tag |
105+
| /botnet endpoint with `c2_domain` populated | `ipv4-addr--<c2_domain>` | `id` | Templated |
106+
| /botnet endpoint with `c2_domain` populated | `c2_domain` | `indicator` | |
107+
| /botnet endpoint with `c2_domain` populated | | `type` | Statically set to `domain-name` |
108+
| /botnet endpoint with `c2_domain` populated | | `threatType` | Statically set to `compromised` |
109+
| /botnet endpoint with `c2_domain` populated | `listed_at` | `validFrom` | |
110+
| /botnet endpoint with `c2_domain` populated | `tags` | `confidence` | Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
111+
| /c2-domains endpoint with `domain` populated | `domain-name--<domain>` | `id` | Templated |
112+
| /c2-domains endpoint with `domain` populated | `domain` | `indicator` | |
113+
| /c2-domains endpoint with `domain` populated | | `type` | Statically set to `domain-name` |
114+
| /c2-domains endpoint with `domain` populated | | `threatType` | Statically set to `compromised` |
115+
| /c2-domains endpoint with `domain` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
116+
| /c2-domains endpoint with `domain` populated | `tags` | `confidence` | Default statically set to `75`, but set to `25` if `c2_domain_top_1m` found as a tag |
117+
| /c2-domains endpoint with each `Ip_addresses` populated | `ipv4-addr--<c2_ip_address>` or `ipv6-addr--<c2_ip_address>` | `id` | Templated. Depends if value is IPv4 or IPv6 |
118+
| /c2-domains endpoint with each `Ip_addresses` populated | `[]Ip_addresses` | `indicator` | The specific value in the list |
119+
| /c2-domains endpoint with each `Ip_addresses` populated | | `type` | Statically set to `ipv4-addr` or `ipv6-addr` |
120+
| /c2-domains endpoint with each `Ip_addresses` populated | | `threatType` | Statically set to `compromised` |
121+
| /c2-domains endpoint with each `Ip_addresses` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
122+
| /c2-domains endpoint with each `Ip_addresses` populated | | `confidence` | Statically set to `50` |
123+
| /disruption endpoint with `url` populated | `url--<url>` | `id` | Templated |
124+
| /disruption endpoint with `url` populated | `url` | `indicator` | |
125+
| /disruption endpoint with `url` populated | | `type` | Statically set to `url` |
126+
| /disruption endpoint with `url` populated | | `threatType` | Statically set to `compromised` |
127+
| /disruption endpoint with `url` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
128+
| /disruption endpoint with `url` populated | | `confidence` | Statically set to `100` |
129+
| /disruption endpoint with `ip` populated | `ipv4-addr--<ip>` | `id` | Templated |
130+
| /disruption endpoint with `ip` populated | `ip` | `indicator` | |
131+
| /disruption endpoint with `ip` populated | | `type` | Statically set to `ipv4-addr` |
132+
| /disruption endpoint with `ip` populated | | `threatType` | Statically set to `compromised` |
133+
| /disruption endpoint with `ip` populated | `created_at` or `updated_at` | `validFrom` | Use the latest of the two |
134+
| /disruption endpoint with `ip` populated | | `confidence` | Statically set to `50` |
135+
| /malware endpoint with `md5` populated | `file:hashes.MD5--<md5>` | `id` | Templated |
136+
| /malware endpoint with `md5` populated | `md5` | `indicator` | |
137+
| /malware endpoint with `md5` populated | `file:hashes.MD5` | `type` | |
138+
| /malware endpoint with `md5` populated | | `threatType` | Statically set to `compromised` |
139+
| /malware endpoint with `md5` populated | `created_at` | `validFrom` | |
140+
| /malware endpoint with `md5` populated | | `confidence` | Statically set to `75` |
141+
| /malware endpoint with `sha1` populated | `file:hashes.'SHA-1'--<sha1>` | `id` | Templated |
142+
| /malware endpoint with `sha1` populated | `sha1` | `indicator` | |
143+
| /malware endpoint with `sha1` populated | `file:hashes.'SHA-1'` | `type` | |
144+
| /malware endpoint with `sha1` populated | | `threatType` | Statically set to `compromised` |
145+
| /malware endpoint with `sha1` populated | `created_at` | `validFrom` |
146+
| /malware endpoint with `sha1` populated | | `confidence` | Statically set to `75` |
147+
| /malware endpoint with `sha256` populated | `file:hashes.'SHA-256'--<sha256>` | `id` | Templated |
148+
| /malware endpoint with `sha256` populated | `sha256` | `indicator` | |
149+
| /malware endpoint with `sha256` populated | `file:hashes.'SHA-256'` | `type` | |
150+
| /malware endpoint with `sha256` populated | | `threatType` | Statically set to `compromised` |
151+
| /malware endpoint with `sha256` populated | `created_at` | `validFrom` | |
152+
| /malware endpoint with `sha256` populated | | `confidence` | Statically set to `75` |
153+
| /malware endpoint with `sha512` populated | `file:hashes.'SHA-512'--<sha512>` | `id` | Templated |
154+
| /malware endpoint with `sha512` populated | `sha512` | `indicator` | |
155+
| /malware endpoint with `sha512` populated | `file:hashes.'SHA-512'` | `type` | |
156+
| /malware endpoint with `sha512` populated | | `threatType` | Statically set to `compromised` |
157+
| /malware endpoint with `sha512` populated | `created_at` | `validFrom` | |
158+
| /malware endpoint with `sha512` populated | | `confidence` | Statically set to `75` |
159+
| /phishing endpoint with `domain` populated |` domain-name--<domain>` | `id` | Templated |
160+
| /phishing endpoint with `domain` populated | `domain` | `indicator` | |
161+
| /phishing endpoint with `domain` populated | | `type` | Statically set to `domain-name` |
162+
| /phishing endpoint with `domain` populated | | `threatType` | Statically set to `compromised` |
163+
| /phishing endpoint with `domain` populated | `scanned` | `validFrom` | |
164+
| /phishing endpoint with `domain` populated | | `confidence` | Statically set to `50` |
165+
| /phishing endpoint with `url` populated |` url--<domain>` | `id` | Templated |
166+
| /phishing endpoint with `url` populated | `url` | `indicator` | |
167+
| /phishing endpoint with `url` populated | | `type` | Statically set to `url` |
168+
| /phishing endpoint with `url` populated | | `threatType` | Statically set to `compromised` |
169+
| /phishing endpoint with `url` populated | `scanned` | `validFrom` | |
170+
| /phishing endpoint with `url` populated | | `confidence` | Statically set to `50` |
171+
| /ransomware endpoint with `md5` populated | `file:hashes.MD5--<md5>` | `id` | Templated |
172+
| /ransomware endpoint with `md5` populated | `md5` | `indicator` | |
173+
| /ransomware endpoint with `md5` populated | `file:hashes.MD5` | `type` | |
174+
| /ransomware endpoint with `md5` populated | | `threatType` | Statically set to `compromised` |
175+
| /ransomware endpoint with `md5` populated | `created_at` | `validFrom` | |
176+
| /ransomware endpoint with `md5` populated | | `confidence` | Statically set to `75` |
177+
| /ransomware endpoint with `sha1` populated | `file:hashes.'SHA-1'--<sha1>` | `id` | Templated |
178+
| /ransomware endpoint with `sha1` populated | `sha1` | `indicator` | |
179+
| /ransomware endpoint with `sha1` populated | `file:hashes.'SHA-1'` | `type` | |
180+
| /ransomware endpoint with `sha1` populated | | `threatType` | Statically set to `compromised` |
181+
| /ransomware endpoint with `sha1` populated | `created_at` | `validFrom` | |
182+
| /ransomware endpoint with `sha1` populated | | `confidence` | Statically set to `75` |
183+
| /ransomware endpoint with `sha256` populated | `file:hashes.'SHA-256'--<sha256>` | `id` | Templated |
184+
| /ransomware endpoint with `sha256` populated | `sha256` | `indicator` | |
185+
| /ransomware endpoint with `sha256` populated | `file:hashes.'SHA-256'` | `type` | |
186+
| /ransomware endpoint with `sha256` populated | | `threatType` | Statically set to `compromised` |
187+
| /ransomware endpoint with `sha256` populated | `created_at` | `validFrom` | |
188+
| /ransomware endpoint with `sha256` populated | | `confidence` | Statically set to `75` |
189+
| /ransomware endpoint with `sha512` populated | `file:hashes.'SHA-512'--<sha512>` | `id` | Templated |
190+
| /ransomware endpoint with `sha512` populated | `sha512` | `indicator` | |
191+
| /ransomware endpoint with `sha512` populated | `file:hashes.'SHA-512'` | `type` | |
192+
| /ransomware endpoint with `sha512` populated | | `threatType` | Statically set to `compromised` |
193+
| /ransomware endpoint with `sha512` populated | `created_at` | `validFrom` | |
194+
| /ransomware endpoint with `sha512` populated | | `confidence` | Statically set to `75` |
195+
196+
### Type mapping for ZeroFox
197+
198+
The `type` object is mapped to the following normalized type values:
199+
200+
| Original type | Normalized type in the datastore |
201+
|:--|:--|
202+
| `c2_domain` | `domain-name` |
203+
| `c2_ip_address` | `ip_address` |
204+
| `domain` | `domain-name` |
205+
| `ip` | `ipv4-addr` |
206+
| `ip_address` | `ip_address` |
207+
| `Ip_addresses` | `ipv4-addr` or `ipv6-addr` |
208+
| `url` | `url` |

‎sidebars.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3071,6 +3071,7 @@ integrations: [
30713071
'security/threat-intelligence/find-threats',
30723072
'security/threat-intelligence/threat-intelligence-indicators',
30733073
'security/threat-intelligence/upload-formats',
3074+
"security/threat-intelligence/threat-intelligence-mapping",
30743075
],
30753076
},
30763077
],

0 commit comments

Comments
 (0)