Current ThreatQ Version Filter
 

CISA Alerts CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The CISA Alerts CDF consumes data provided by the CISA to notify organizations about threats that exist on the Internet.

The integration provides the following feeds:

  • CISA Alerts - creates a ThreatQ Alert Event and any related objects

The integration ingests the following system objects:

  • Reports
    • Report Attributes

The CISA Advisories and CISA Alerts CDFs replace the deprecated US-CERT Alerts CDF.

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the OSINT option from the Category dropdown (optional).

    If you are installing the integration for the first time, it will be located under the Disabled tab.

  3. Click on the integration entry to open its details page.
  4. Enter the following parameters under the Configuration tab:
    Parameter Description
    Verify Host SSL When checked, validates the host-provided SSL certificate.  This option is checked by default.

  5. Review any additional settings, make any changes if needed, and click on Save.
  6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

CISA Alerts

This feed creates a ThreatQ Alert Event and any related objects.

GET https://www.cisa.gov/cybersecurity-advisories/alerts.xml

Sample Response:

<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0" xml:base="https://www.cisa.gov/">
  <channel>
    <title>Alerts</title>
    <link>https://www.cisa.gov/</link>
    <description/>
    <language>en</language>
    
    <item>
  <title>CISA Releases Five Industrial Control Systems Advisories</title>
  <link>https://www.cisa.gov/news-events/alerts/2023/05/18/cisa-releases-five-industrial-control-systems-advisories</link>
  <description>&lt;p&gt;CISA released five Industrial Control Systems (ICS) advisories on May 16, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. &lt;/p&gt;
&lt;ul&gt;&lt;li&gt;ICSA-23-138-01 &lt;a href="https://cisa.gov/news-events/ics-advisories/icsa-23-138-01"&gt;Carlo Gavazzi Powersoft&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;ICSA-23-138-02 &lt;a href="https://cisa.gov/news-events/ics-advisories/icsa-23-138-02"&gt;Mitsubishi Electric MELSEC WS&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;ICSA-23-138-03 &lt;a href="https://cisa.gov/news-events/ics-advisories/icsa-23-138-03"&gt;Hitachi Energy MicroSCADA Pro/X SYS600&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;ICSA-23-138-04 &lt;a href="https://cisa.gov/news-events/ics-advisories/icsa-23-138-04"&gt;Johnson Controls OpenBlue Enterprise Manager Data Collector&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;ICSA-20-051-02 &lt;a href="https://cisa.gov/news-events/ics-advisories/icsa-20-051-02"&gt;Rockwell Automation FactoryTalk Diagnostics Update B&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;&lt;p&gt; &lt;/p&gt;
&lt;p&gt;CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.&lt;/p&gt;
</description>
  <pubDate>Thu, 18 May 23 12:00:00 +0000
</pubDate>
    <dc:creator>CISA</dc:creator>
    <guid isPermaLink="false">/node/18192</guid>
    </item>
  </channel>
</rss>

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity Threat Q Object Type or Attribute Key Published Date Examples Notes
.rss.channel.item[].title Report.Title N/A .rss.channel.item[].pubDate CISA Releases Five Industrial Control Systems Advisories: Thu, 18 May 23 12:00:00 +0000 PubDate appended to title
.rss.channel.item[].description Report.Description N/A N/A CISA released five Industrial Control Systems (ICS) ... N/A
.rss.channel.item[].link Report.Attribute URL .rss.channel.item[].pubDate https://www.cisa.gov/news-events/alerts/2023/05/18/cisa-releases-five-industrial-control-systems-advisories N/A
N/A Report.Attribute NCAS Feed Name .rss.channel.item[].pubDate Current Activity N/A

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

CISA Alerts CDF

Metric Result
Run Time <1 minute
Reports 10
Report Attributes 20

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
CISA Alerts CDF Guide v1.0.0 4.52 or Greater