Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The DCSO TIE feed ingests IoCs and related attributes from DCSO's TIE using the following endpoint:

• DCSO TIE - ingests indicators with related attributes.

The integration ingests the following indicator sub-types:

The indicators ingested will have the following attributes:

• Minimum and Maximum Severity
• Minimum and Maximum Confidence
• Actors
• Families
• Categories
• Entities

Prerequisites

Review the follow prerequisite before attempting to install the CDF.

DCSO TIE Access Token

You will need your DSCO TIE Access Token in order to use the DSCO TIE CDF integration.  You can find your DCSO TIE access token on your DCSO TIE instance under Settings > Access Tokens.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Access Token	Your DCSO.de access token to use for authentication.
   Severity Range	The severity range of IoCs you wish to receive, formatted as min-max or simply an integer between 0 and 5. The default setting is 1-5.
   Confidence Range	The confidence range of IoCs you wish to receive, formatted as min-max or simply an integer between 0 and 100. The default setting is 60-100.
   IOC Category	Enter a single value or a comma-separated list of category names. If given, the integration will only return data which have at least one observation that matches at least one of the given values, or (if match_all includes category) all of the given values. You can prepend a ! character to a category to get only IoCs that do not have that IOC category name.  Example: !malware.
   Malware Family Name	Enter a single value or a comma-separated list of malware family names (as returned by the families endpoint).  If given, the integration will only return data which have at least one observation that matches at least one of the given values, or (if match_all includes family) all of the given values. This entry can be negated by prepending a ! character.  Example: !tesla will only show data for which there is at least one observation that is not related to a tesla malware.
   Threat Actor Name	Enter a single value or a comma-separated list of threat actor names (as returned by the threat actor endpoint).  If given, the integration will only return data which have at least one observation that matches at least one of the given values, or (if match_all includes threat actor) all of the given values. This entry can be negated by prepending a ! character.  Example: !fin7 will only show data for which there is at least one observation that is not related to a fin7 threat actor.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
  "has_more": true,
  "params": {
    "direction": "desc",
    "limit": 10,
    "confidence": "60-100",
    "severity": "1-5",
    "offset": 0,
    "order_by": "created_at"
  },
  "iocs": [
    {
      "data_type": "DomainName",
      "actors": [
        "bengal"
      ],
      "categories": [
        "c2-server"
      ],
      "families": [
        "andromeda"
      ],
      "first_seen": "2016-09-28 17:07:24.216720+02:00",
      "last_seen": "2016-09-28 17:07:24.216720+02:00",
      "created_at": "2016-09-28 18:03:47.138723+02:00",
      "updated_at": "2016-09-28 18:03:47.138723+02:00",
      "id": "3c5db453-873f-4107-994b-d27389de94e1",
      "max_confidence": 100,
      "max_severity": 3,
      "min_confidence": 80,
      "min_severity": 2,
      "entity_ids" : [
        "D7F7D360-DABE-30DF-B1ED-D72892ADA72D"
      ],
      "n_occurrences": 2,
      "sources": [
        "malwaredomainlist",
        "payload_security"
      ],
      "value": "www.ozowarac.com"
    },
    #...
  ]
}     

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

The following run is working with 1 hour worth of data from DCSO TIE - from February 9, 2022 at 4:09pm to February 9, 2022 at 5:09pm.

Known Issues / Limitations

• DCSO's TIE can encompass a large amount of IoCs.  When this number is especially high (~ >20000), the feed will throw a 504 Gateway Time-out error. This error is caused by DCSO TIE servers.

  To avoid this error, this feed has several configuration options (Severity, Confidence, Query Time Range) to limit the number of IoCs being ingested to a more reasonable amount.  ThreatQuotient strongly recommends that users utilize these configurations to keep the feed query time range configuration between 1-2 hours.

  The same 504 Gateway Time-out error can also be caused if incompatible configurations are entered.  This will cause the server to continuously load to find IoCs with the specified parameters but finding none and timing out.  This error will not stop the feed run.

Change Log

• Version 1.0.1
  • IP Addresses are now ingested as CIDR Blocks and IP Addresses (without netmask) in ThreatQ.  See the IoC Type Mapping section for more details.  
• Version 1.0.0
  • Initial release