Devo Alerts CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Devo Alerts

The Devo Alerts feed periodically pulls alerts from Devo, into ThreatQ

Sample Response:

GET https://{{ region }}/alerts/v1/alerts/list

[
    {
        "id": 92133628,
        "domain": "threatquotient",
        "priority": 10,
        "context": "my.alert.threatquotient.Suspiciously_Large_POST_Requests",
        "category": "my.context",
        "srcPort": null,
        "srcIp": null,
        "srcHost": null,
        "dstIp": null,
        "dstPort": null,
        "dstHost": null,
        "protocol": null,
        "username": null,
        "application": null,
        "engine": "pilot-4-pro-cloud-custom-aws-us-east-1",
        "extraData": "{\"count\":\"49\",\"eventdate\":\"2022-08-02+14%3A00%3A00.0\"}",
        "alertDate": null,
        "creationDate": null,
        "status": 100,
        "ack_status_date": null,
        "createDate": 1659450636000,
        "updateDate": 1659455802000,
        "scaled": false,
        "digest": "6c8c322006f9c38d6c726972cbfc59a58e91f120",
        "uniquedigest": "fbeb2fef7b04391d0365b1b791d15e76e8a3fda8",
        "contexto": null,
        "postAlertAction": null,
        "contextLabel": null,
        "contextSubscription": null,
        "shouldSend": false,
        "recoveryId": null,
        "skipAntiflooding": false,
        "useCreationDate": false,
        "alertOwner": null,
        "fullExtraData": null,
        "alertType": null,
        "alertMitreTactics": null,
        "alertMitreTechniques": null,
        "alertPriority": null,
        "alertDefinition": {
            "id": "187427",
            "creationDate": 1659450388000,
            "name": "Suspiciously Large POST Requests",
            "message": "Large POST Requests",
            "description": "This is the alert description",
            "categoryId": "3593",
            "subcategory": "lib.my.threatquotient.Suspicious_Sighting",
            "subcategoryId": "3431",
            "isActive": true,
            "isFavorite": false,
            "isAlertChain": false,
            "alertCorrelationContext": {
                "id": "41646",
                "nameId": "my.alert.threatquotient.Suspiciously_Large_POST_Requests",
                "ownerEmail": "zach.shames@threatq.com",
                "querySourceCode": "from demo.ecommerce.data\n\twhere method = \"POST\"\n    and statusCode = 200\n    and bytesTransferred > 3000\n  select isnotnull(`lu/ThreatQ_Blacklist_IP_Address/threatq_link`(str(clientIpAddress))) as `ThreatQ Match`,\n    `lu/ThreatQ_Blacklist_IP_Address/score`(str(clientIpAddress)) as `ThreatQ Score`,\n    `lu/ThreatQ_Blacklist_IP_Address/malware_family`(str(clientIpAddress)) as `Malware Family`,\n    `lu/ThreatQ_Blacklist_IP_Address/adversary`(str(clientIpAddress)) as Adversary,\n    `lu/ThreatQ_Blacklist_IP_Address/tags`(str(clientIpAddress)) as `ThreatQ Tags`",
                "priority": 5,
                "correlationTrigger": {
                    "kind": "several",
                    "period": 1800000,
                    "threshold": 10,
                    "keys": []
                }
            },
            "actionPolicyId": []
        },
        "allExtraDataFields": {
            "count": "49",
            "eventdate": "2022-08-02+14%3A00%3A00.0"
        },
        "tags": null,
        "entities": null,
        "commentsList": null,
        "alertLabel": "[threatquotient:my.alert.threatquotient.Suspiciously_Large_POST_Requests:92133628]"
    }
]

ThreatQ provides the following default mapping for feed:

The following data paths are based on each item within the response list.

Devo Alert Details (Supplemental)

The Devo Alert Details supplemental feed fetches the full context for a given alert, by ID.

GET https://{{ region }}/alerts/v1/alerts/get?id={{ alert_id }}&tags=true&annotations=true

Sample Response:

{
    "id": 92133628,
    "domain": "threatquotient",
    "priority": 10,
    "context": "my.alert.threatquotient.Suspiciously_Large_POST_Requests",
    "category": "my.context",
    "srcPort": null,
    "srcIp": null,
    "srcHost": null,
    "dstIp": null,
    "dstPort": null,
    "dstHost": null,
    "protocol": null,
    "username": null,
    "application": null,
    "engine": "pilot-4-pro-cloud-custom-aws-us-east-1",
    "extraData": "{\"count\":\"49\",\"eventdate\":\"2022-08-02+14%3A00%3A00.0\"}",
    "alertDate": null,
    "creationDate": null,
    "status": 100,
    "ack_status_date": null,
    "createDate": 1659450636000,
    "updateDate": 1659455802000,
    "scaled": false,
    "digest": "6c8c322006f9c38d6c726972cbfc59a58e91f120",
    "uniquedigest": "fbeb2fef7b04391d0365b1b791d15e76e8a3fda8",
    "contexto": null,
    "postAlertAction": null,
    "contextLabel": null,
    "contextSubscription": null,
    "shouldSend": false,
    "recoveryId": null,
    "skipAntiflooding": false,
    "useCreationDate": false,
    "alertOwner": null,
    "fullExtraData": null,
    "alertType": null,
    "alertMitreTactics": null,
    "alertMitreTechniques": null,
    "alertPriority": null,
    "alertDefinition": null,
    "allExtraDataFields": null,
    "tags": null,
    "entities": null,
    "commentsList": [
        {
            "id": 160512,
            "author": {
                "id": 43709,
                "user": {
                    "id": "94b7d52a-e590-42d6-96eb-43e21e58154f",
                    "email": "zach.shames@threatq.com",
                    "username": "Zach Shames",
                    "telephone": "",
                    "pwd": "03i5ip401y5FrSXRdpHv2y8RMom424m/rDloi/5tspM=$Z8r4L6LUh45WkWKH18S87rAJeorqHwsqOfMA9HovqAk=",
                    "status": 0,
                    "validation_token": null,
                    "defaultDomain": "threatquotient",
                    "updateDate": 1659447389000,
                    "creationDate": 1658956699000,
                    "otpSecret": null,
                    "loginAttempts": 0,
                    "recoveryAttempts": 0
                },
                "domain": {
                    "id": "a7c2c8f7-efed-4148-9eda-e2b7b08c8248",
                    "name": "threatquotient",
                    "status": 0,
                    "type": 11,
                    "updateDate": 1658952948000,
                    "creationDate": 1658952948000,
                    "subscribed": 0,
                    "daysLeft": 30,
                    "showLanding": true,
                    "reseller": null,
                    "groupId": null,
                    "alertsLastReseted": null
                },
                "lastTimeLogged": 1659447394000,
                "status": 0,
                "creationDate": 1658953155000,
                "updateDate": 1659456938000,
                "pwd": null,
                "validationToken": null,
                "roleCustom": null,
                "rolesCustom": null,
                "externalId": null,
                "owner": false,
                "alertsLastVisited": 1659456938000
            },
            "msg": "This is the annotation's description\nN/A",
            "ack": "{\"ackUserList\":[\"94b7d52a-e590-42d6-96eb-43e21e58154f\"]}",
            "creationDate": 1659456970000,
            "updateDate": 1659456970000,
            "elementType": "alert",
            "elementId": "92133628",
            "domain": {
                "id": "a7c2c8f7-efed-4148-9eda-e2b7b08c8248",
                "name": "threatquotient",
                "status": 0,
                "type": 11,
                "updateDate": 1658952948000,
                "creationDate": 1658952948000,
                "subscribed": 0,
                "daysLeft": 30,
                "showLanding": true,
                "reseller": null,
                "groupId": null,
                "alertsLastReseted": null
            },
            "title": "This is a demo annotiation",
            "status": null,
            "task": false
        }
    ],
    "alertLabel": "[threatquotient:my.alert.threatquotient.Suspiciously_Large_POST_Requests:92133628]"
}

ThreatQ provides the following default mapping for this feed:

PDF Guides