Skip to content

Commit a2d7f8d

Browse files
committed
[doc] Update opencti generating scenario doc
1 parent d1b802e commit a2d7f8d

File tree

7 files changed

+25
-4
lines changed

7 files changed

+25
-4
lines changed
Loading
33.3 KB
Loading
Loading
Loading
Loading
Loading

docs/usage/scenario/opencti_scenario.md

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,43 @@ This integration works across multiple entities:
1010
- Grouping
1111
- Incident Response
1212
- Malware
13-
- Campaings
13+
- Campaigns
1414
- Intrusion
1515
- Request For Information
1616
- Request For Takedown
1717

1818
![simulate button](assets/simulate-btn.png)
1919

20-
When you click on the simulate button, you’ll have two options:
20+
When you click the "Simulate" button, a form will appear with the following fields:
2121

22-
- Generate a scenario based on technical injects
23-
- Generate a scenario based on email injects, using AI to automatically generate email content
22+
| Property | Description |
23+
|------------------------------------------------------------------|---------------------------------------------------------------|
24+
| Simulation type | Can be either "Technical" (payloads) or "Simulated" (emails) |
25+
| Interval between injection (in minutes) | The time between each injection execution |
26+
| Number of injects generated by attack <br/>pattern and platform | |
27+
28+
![simulation simulated](assets/octi-form-options.png)
29+
![simulation simulated](assets/octi-form-simulated.png)
30+
31+
If you choose the "Technical" (payloads) simulation type, you will also need to fill in the following fields:
32+
33+
| Property | Description |
34+
|------------------------------------------------------------------|--------------------------------------------------------------------|
35+
| Targeted platforms | Supported platforms for executing the TTPs (Windows, Linux, macOS) |
36+
| Targeted architecture | Supported architectures for executing the TTPs (x86_64, arm64) |
37+
38+
![simulation technical(payloads)](assets/octi-form-technical.png)
39+
![simulation technical(payloads)](assets/octi-form-tech-arch.png)
40+
![simulation technical(payloads)](assets/octi-alert-technical.png)
2441

2542
It’s essential to understand that a scenario creation for these entities relies on matching TTPs between OpenCTI and
2643
OpenBAS. You’ll need to ensure that the TTPs in both platforms are aligned. For instance, if your report contains the
2744
TTP T1059.001, a scenario can be created with an inject, provided OpenBAS also includes T1059.001.
2845

46+
If these TTPs are not supported by OpenBAS, you will receive an alert listing the uncovered TTPs.
47+
48+
![ttps not covered obas](assets/octi-ttp-not-covered.png)
49+
2950
When generating a scenario from OpenCTI, a scenario is created and can be accessed from the scenarios screen. The
3051
scenario name will include a reference to OpenCTI, indicating its origin. This scenario will automatically contain
3152
relevant sequences of injects based on the threat context identified in OpenCTI.

0 commit comments

Comments
 (0)