Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The RSA NetWitness Incidents CDF for ThreatQuotient enables ThreatQ to automatically ingest incidents and their related indicators from RSA NetWitness.

The integration ingests threat intelligence data from the following endpoints:

• RSA NetWitness Incidents (Feed) - fetches all incidents from RSA NetWitness, within a given timeframe. Each incident will be parsed for metadata and related indicators, and the intelligence will be uploaded to ThreatQ.
• Get API Token (Supplemental) - authenticates using user credentials to get back an access token used for each subsequent request.

The integration ingests the following system object types:

• Incidents
  • Incident Attributes
• Indicators
  • Indicator Attributes

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   RSA NetWitness Hostname/IP (and port)	Your RSA NetWitness Hostname/IP, along with the port (if applicable).
   RSA NetWitness Login	Your RSA NetWitness Login (username) to authenticate with the API.
   RSA NetWitness Password	Your RSA NetWitness Login (password) to authenticate with the API.
   Alert Rules	An optional comma-delimited list of alert rules. This will limit the ingested incidents only to ones created by these rules.
   Priority Filter	The incident priorities to be ingested.  Options include: Low Medium (default) High (default) Critical (default)
   Minimum Risk Score Threshold	The minimum risk score threshold for incidents to be ingested. The default setting is 50.
   Skip Closed Incidents	Checkbox to control whether to ingest close incidents. The default setting is false.
   Skip Remediated Incidents	Checkbox to control whether to ingest remediated incidents. The default setting is false.
   Verify SSL Certificate	Checkbox to enable or disable SSL certificate verification.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "items": [
        {
            "id": "INC-708",
            "title": "High Risk Alerts: ESA for 119.45.42.241",
            "summary": "",
            "priority": "High",
            "riskScore": 50,
            "status": "New",
            "alertCount": 1,
            "averageAlertRiskScore": 50,
            "sealed": false,
            "totalRemediationTaskCount": 0,
            "openRemediationTaskCount": 0,
            "created": "2021-07-08T15:16:00.696Z",
            "lastUpdated": "2021-07-08T15:16:00.696Z",
            "lastUpdatedBy": null,
            "assignee": null,
            "sources": [
                "Event Stream Analysis"
            ],
            "ruleId": "5ffdec73cf797e197669c5f0",
            "firstAlertTime": "2021-07-08T15:15:46.290Z",
            "categories": [],
            "journalEntries": null,
            "createdBy": "High Risk Alerts: ESA",
            "deletedAlertCount": 0,
            "eventCount": 1,
            "alertMeta": {
                "SourceIp": [
                    "119.45.42.241"
                ],
                "DestinationIp": [
                    "172.24.131.192"
                ]
            }
        },
        {
            "id": "INC-707",
            "title": "High Risk Alerts: ESA for 81.68.246.68",
            "summary": "",
            "priority": "High",
            "riskScore": 50,
            "status": "New",
            "alertCount": 2,
            "averageAlertRiskScore": 50,
            "sealed": false,
            "totalRemediationTaskCount": 0,
            "openRemediationTaskCount": 0,
            "created": "2021-07-08T15:16:00.677Z",
            "lastUpdated": "2021-07-08T15:16:00.677Z",
            "lastUpdatedBy": null,
            "assignee": null,
            "sources": [
                "Event Stream Analysis"
            ],
            "ruleId": "5ffdec73cf797e197669c5f0",
            "firstAlertTime": "2021-07-08T15:15:46.265Z",
            "categories": [],
            "journalEntries": null,
            "createdBy": "High Risk Alerts: ESA",
            "deletedAlertCount": 0,
            "eventCount": 2,
            "alertMeta": {
                "SourceIp": [
                    "81.68.246.68"
                ],
                "DestinationIp": [
                    "172.21.225.14",
                    "172.18.205.42"
                ]
            }
        }
    ]
}

{
  "id": "admin",
  "roles": [
    "Administrators"
  ],
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9....",
  "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MjgzNTA3NDc1NjUsImlzcyI6InNlY3VyaXR5LXNlcnZlci00NzdjNzgzZS0wNzlhLTRjNWYtODdkNC03NDBhNTc5MmUyM2UiLCJpYXQiOjE2MjU3NTg3NDc1NjUsInJlZnJlc2giOnRydWUsInVzZXJfbmFtZSI6ImFkbWluIn0....."
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.1.1
  • Fixed an issue where the items.categories attributes were set to null in the response data.
  • Fixed an issue that occurred when Alert Rules are not specified.
• Version 1.1.0
  • Added an optional configuration parameter: Alert Rules.  
• Version 1.0.0
  • Initial Release