Plugin development

[tim-acki]

Hello,

i would like to develop an own Plugin for threatbus. In the description are links to a guide on how to write a plugin (https://docs.tenzir.com/threatbus/plugins/plugin-development) and different plugin types (https://docs.tenzir.com/threatbus/plugins/overview). Unfortunately both links are redirected to the main page of vast.io, where i am not able to find the guides. Are the guides now located anywhere else and I am unable to find them? If not would it be possible to still get access to the guides?

Thanks in advance

Kind regards

[mavam]

Hi @tim-acki, thanks for reaching out! I'm sorry that the information is not very easily to put together. We are amidst a rewrite of Threat Bus, which itself is in maintenance mode.

The core functionality, pub-sub via STIX, was limited to Indicator SDOs and Sighting SROs in Threat Bus. We're opening up the fabric for a more flexible form of interconnection that also involve more complex objects, e.g., entire STIX bundles coming from MISP, or to contextualized alerts and then relay them to TheHive.

We are still in an alpha stage with this effort, but depending on your use case, this might actually be a good time to chime in and describe your use case. You can do that here or also interactively in our community Slack at http://slack.tenzir.com. Looking forward to hearing from you!

[tim-acki]

Hi @mavam, my use case is the integration of threat intelligence data into an existing SIEM system . I am using MISP and OpenCTI for gathering threat intelligence data and want to explore how to best use the data in a SIEM in order to support automatic detection. I identified different possible points including Zeek and Suricata which are used in the SIEM. As threatbus already offers plugins for both these tools I thought it would be a good start to use it for the data exchange. Additionally, I identified Sigma rules as a possible target for conversion (MISP->Sigma) to allow detection in log data. I therefore thought about extending threatbus with a plugin to also integrate it with the Sigma application in my SIEM.

[mavam]

Hi @tim-acki, this sounds really interesting. A few questions:

• Do you have Sigma rules in MISP and/or OpenCTI? If so, these can be embedded directly in the Indicator STIX SDO. We have working conversion of this using misp-stix, so the MISP-to-STIX part is ready to use.
• How do you want to trigger threat intel going to the bus/fabric? Do you want to all updates to MISP events to show up? What OpenCTI objects do you want to export as STIX to the fabric? Reports? Your own Groupings or Bundles?
• What's your use case for Zeek? We want to push STIX observables into Zeek's Intel Framework.
• The same for Suricata: we want to accumulate the Suricata rules in Indicator SDOs and reload them on-the-fly by the Suricata app

[tim-acki]

Hi @mavam,
I do not have a lot of intelligence data directly present as sigma rules, the main part will be present in the misp format. For I am using some standard feeds in MISP. I was planning to convert them to Sigma rules using something like sigmai (https://github.com/0xThiebaut/sigmai) and then send them to the sigma app.
Currently I plan to trigger the data exchange by updates to MISP events but that may change going forward.
Zeek is mainly used as a network security monitor to log network traffic, the plan is to use the intelligence framework to find indicators in the log files. The same goes for suricata, I plan to convert the intelligence data to suricata rules in order to enable alerting on live traffic. As far as I understand these two use cases are exactly what threatbus offers.
Concerning what intelligence data is send to which application (Sigma/Suricata/Zeek) remains an open question and requires some testing.
Would you recommend to generally use the "old" version of Threat bus prior to the rewrite you are doing?

[mavam]

I was planning to convert them to Sigma rules using something like sigmai (https://github.com/0xThiebaut/sigmai) and then send them to the sigma app

Interesting. Thanks for sharing sigmai. Taking a step back and reflecting on the approach: it may make sense from a unification purpose of developing a Sigma-native detection engine, but I would be a bit reluctant to encode observables in a Sigma rule. It may work, but I since Sigma has its own event taxonomy, I think you lose too much context and typing. (Not trying to dismiss the approach, just sharing my opinion 🙂)

I feel a better target for encoding would be a more powerful model, like STIX. There's a cleaner path from MISP to STIX objects, and STIX Indicator SDOs can also carry Sigma rules natively if you get them from elsewhere.

Zeek is mainly used as a network security monitor to log network traffic, the plan is to use the intelligence framework to find indicators in the log files. The same goes for suricata, I plan to convert the intelligence data to suricata rules in order to enable alerting on live traffic. As far as I understand these two use cases are exactly what threatbus offers.

That's correct! Although it's limited to the Indicator SDO as vehicle, followed by Sighting SRO as response. From our own experience, we found this too restrictive. Our new prototype already works with entire STIX bundles and is capable of deeper deconstruction.

For Suricata, we would like to take a STIX-based approach like IOCmite: translate STIX SCOs into datasets.

Concerning what intelligence data is send to which application (Sigma/Suricata/Zeek) remains an open question and requires some testing.

Here's how we think about it:

• Zeek: a special-purpose solution makes only sense if you push indicators to Zeek that match on events that will never show up in logs (e.g., sensitive stuff like PII data, e.g., SSNs). Otherwise matching downstream on log data is more convenient and general.

• Suricata: IoCs ideally go into datasets, corresponding alerts that fire on datasets should be treated as sightings.

• Sigma: can operate both on Suricata and Zeek metadata. They should translate into SIEM queries and ideally also be matched live on incoming events.

Would you recommend to generally use the "old" version of Threat bus prior to the rewrite you are doing?

I would recommend to wait a couple of months, if you can. In fact, I'd love to see if we can collaborate during the current rewrite phase to make sure we're covering your use case specifically. Feel free to reach out anytime (matthias@tenzir.com).

[dominiklohmann]

If not would it be possible to still get access to the guides?

The Threat Bus docs moved to vast.io/docs/use-vast/integrate/threatbus. All the information is still present.

[tim-acki]

Thank you!