infoblox:tide
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| infoblox:tide [2023/11/16 12:15] – bstafford | infoblox:tide [2024/12/27 15:12] (current) – removed bstafford | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== TIDE ====== | ||
| - | TIDE is Threat Intelligence Data Exchange. It is effectively a very large Threat Database that is managed by the Infoblox Threat Intelligence Team. From its database, the Infoblox RPZ feeds are generated. | ||
| - | ===== Active Indicators ===== | ||
| - | In the CSP > Research > Active Indicators, we can't see RPZ membership of threats. This is expected as this page is a simple GUI interface to the Threat Intel database. RPZ membership can be found in Dossier lookups or (ideally) via API lookups. | ||
| - | ===== Test RPZ Data ===== | ||
| - | Infoblox has harmless test domains that are in various RPZ feeds. This allows you to test that a given RPZ feed is active and working as well as generate example logs, etc. | ||
| - | |||
| - | Test RPZ data [[infoblox: | ||
| - | ===== Get Custom RPZ Data===== | ||
| - | Get all custom RPZ feeds and Country Based RPZ feeds | ||
| - | < | ||
| - | |||
| - | You will get a lot of data back. Each feed has an ID. Use that to limit further queries to pull just that feed. | ||
| - | < | ||
| - | |||
| - | |||
| - | ===== What is In the Custom RPZ Feed Options ===== | ||
| - | |||
| - | * IID | ||
| - | * AISCOMM | ||
| - | * EmergingThreats | ||
| - | * FarsightSecurity | ||
| - | * SURBL (no longer available?) | ||
| - | * 0011A00002BcDwEFG | ||
| - | |||
| - | |||
| - | Infoblox Curated Data | ||
| - | * IID:ANALYST | ||
| - | * IID:CRIME | ||
| - | * IID:DTQ_IP | ||
| - | * IID:IID | ||
| - | * IID:IID Internal | ||
| - | * IID: | ||
| - | * IID:IID_IRD | ||
| - | * IID:IID_TTL | ||
| - | * IID: | ||
| - | * IID:OTHER | ||
| - | * IID:PARTNER | ||
| - | * IID: | ||
| - | * IID: | ||
| - | * IID: | ||
| - | * IID:IB_NOC | ||
| - | * IID:IB_PM | ||
| - | * IID:IB_DS | ||
| - | * IID:IB_SE | ||
| - | |||
| - | Infoblox 3rd Party Data | ||
| - | * AISCOMM: | ||
| - | * EmergingThreats: | ||
| - | * EmergingThreats: | ||
| - | * EmergingThreats: | ||
| - | * FarsightSecurity: | ||
| - | * SURBL: | ||
| - | * SURBL: | ||
| - | |||
| - | SUBRL is SPAM URI (Uniform Resource Identifier) Real-time Block List. | ||
| - | |||
| - | =====Your Uploaded Data===== | ||
| - | * 0011A00001AaA1aAAA: | ||
| - | You can upload data to TIDE via the BloxOne portal (Manage > TIDE Data > Data Upload ) | ||
| - | |||
| - | Documentation [[https:// | ||
| - | |||
| - | Example XML file here: | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | </ | ||
| - | |||
| - | |||
| - | JSON FILE | ||
| - | |||
| - | Notice that the second domain doesn' | ||
| - | < | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | | ||
| - | | ||
| - | | ||
| - | }</ | ||
| - | Upload with CURL | ||
| - | < | ||
| - | |||
| - | The recommended limit for the number of records in a given data submission is 50,000. The maximum number of records should be no more than 60,000 at this point in time. | ||
| - | |||
| - | Documentation [[https:// | ||
| - | ===== Palo Alto Networks Integration ===== | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | Make sure NGINX is installed and serving up / | ||
| - | |||
| - | |||
| - | On PAN-OS Web UI | ||
| - | * Objects > External Dynamic Lists > Add : | ||
| - | * Type = Domain List (So we can use it in Anti-Spyware Profiles) | ||
| - | * Tick " | ||
| - | * Set "Check for updates" | ||
| - | * Click "Test Source URL" | ||
| - | ===== Palo Alto Networks Integration Direct ===== | ||
| - | You can update the External Dynamic List in Palo Alto Networks to use the following URL and download directly from CSP | ||
| - | < | ||
| - | |||
| - | Note the use of the username '' | ||
| - | |||
| - | If you set a Server Certificate in the EDL you can also user username/ | ||
| - | |||
| - | I got this working for domains but not IP feeds. URL feeds don't work directly from Infoblox CSP because the Palo Alto can't handle the inclusion of < | ||
| - | |||
| - | ===== API Examples ===== | ||
| - | ==== Get Latest Threats From TIDE ==== | ||
| - | < | ||
| - | LIMIT=100 | ||
| - | MIN_THREAT_LEVEL=80 | ||
| - | SOURCE=iid | ||
| - | AGE=7d | ||
| - | APIKEY=APIKEY | ||
| - | |||
| - | curl -X GET -H " | ||
| - | ==== Get Bad Nameservers ==== | ||
| - | Get all bad nameservers from the last year. | ||
| - | < | ||
| - | OUTPUT=" | ||
| - | LIMIT=100 | ||
| - | MIN_THREAT_LEVEL=80 | ||
| - | SOURCE=iid | ||
| - | AGE=1y | ||
| - | APIKEY=SET_APIKEY | ||
| - | curl -X GET -H " | ||
| - | ==== Get Newly Observed Domains==== | ||
| - | < | ||
| - | |||
| - | ==== Recent Data ==== | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | ==== Get Top 10 Suspicious Emergent Domains ==== | ||
| - | Using GREP, show top 10 suspicious emergent domains from Infoblox that have been added in the last 48 hours. This list can be fed to External Dynamic List for third party security vendors. | ||
| - | < | ||
| - | ===== Summary of Count of Each Threat Type ===== | ||
| - | < | ||
| - | ==== Get All Critical MalwareC2DGA Threats ==== | ||
| - | Show all critical MalwareC2DGA threats detected in the last 48 hours. Limit results to 10 items. | ||
| - | < | ||
| - | |||
| - | Main bit | ||
| - | < | ||
| - | ... bit - in this case we change class to property = MalwareC2DGA_Locky | ||
| - | < | ||
| - | * Type = Host (type=host) | ||
| - | * Profile = IID (profile=iid) | ||
| - | * Threat Level >= 100 (threat_level_from=100) | ||
| - | * Max Results = 10 (rlimit=10) | ||
| - | * Period = 24h (Results added to TIDE in last 24 Hours) | ||
| - | * Field = detected, | ||
| - | * Property = MalwareC2DGA_Locky (Property to detect) | ||
| - | * Class = MalwareC2DGA (Class to detect) | ||
| - | |||
| - | Format is the following. Replace '' | ||
| - | |||
| - | ==== Get Notes ==== | ||
| - | Retrieve notes in TIDE for a domain example.com: | ||
| - | < | ||
| - | |||
| - | Retrieve new suspicious indicators: | ||
| - | < | ||
| - | |||
| - | ==== Get Notes ==== | ||
| - | (Possibly) " | ||
| - | < | ||
| - | |||
| - | < | ||
| - | ====== Dossier ====== | ||
| - | Dossier [[https:// | ||
| - | |||
| - | * iSIGHT is available as a separate subscription and is not automatically included with Dossier. | ||
| - | |||
| - | ===== RPZ ===== | ||
| - | Remember, if you only have Business Cloud and a threat exists in one of the " | ||
| - | |||
| - | In the event that you query Dossier for a domain that is in both AntiMalware and (e.g.) Suspicious-Lookalikes, | ||
| - | ===== API ===== | ||
| - | |||
| - | Simply query for | ||
| - | * type = HOST | ||
| - | * profile = IID Data | ||
| - | * class= MalwareC2 | ||
| - | * property = MalwareC2_BackdoorRAT | ||
| - | * threatlevel = 80+ | ||
| - | * period = (last) 24h | ||
| - | |||
| - | ==== Get MalwareC2 Threats from Last 24 Hours ==== | ||
| - | |||
| - | < | ||
| - | |||
| - | ==== Check Which RPZ Feeds a Domain is In ==== | ||
| - | |||
| - | < | ||
| - | |||
| - | Same command but use GREP to filter out everything but the feed names. | ||
| - | < | ||
| - | |||
| - | Sam command but with BASH | ||
| - | < | ||
| - | DOMAIN=$1 | ||
| - | APIKEY=" | ||
| - | COMMAND=" | ||
| - | echo "List of RPZ feeds that contain $1" | ||
| - | curl -s -X POST " | ||
| - | |||
| - | ==== Get Infoblox Web Category for Domain ==== | ||
| - | < | ||
| - | DOMAIN=$1 | ||
| - | APIKEY=" | ||
| - | COMMAND=" | ||
| - | echo " | ||
| - | curl -s -X POST " | ||
| - | Other fields you can get | ||
| - | < | ||
| - | ght"," | ||
| - | sl_cert"," | ||
| - | |||
| - | ==== Values for ACS ==== | ||
| - | < | ||
| - | class | ||
| - | confidence | ||
| - | confidence_score | ||
| - | confidence_score_rating | ||
| - | confidence_score_vector | ||
| - | detected | ||
| - | dga | ||
| - | domain | ||
| - | expiration | ||
| - | extended | ||
| - | full_profile | ||
| - | host | ||
| - | id | ||
| - | imported | ||
| - | profile | ||
| - | property | ||
| - | received | ||
| - | risk_score | ||
| - | risk_score_rating | ||
| - | risk_score_vector | ||
| - | threat_level | ||
| - | threat_score | ||
| - | threat_score_rating | ||
| - | threat_score_vector | ||
| - | tld | ||
| - | type | ||
| - | up</ | ||
| - | |||
| - | |||
| - | ===== Check RPZ Feeds ===== | ||
| - | < | ||
| - | # vim: tabstop=8 expandtab shiftwidth=4 softtabstop=4 | ||
| - | |||
| - | import requests | ||
| - | import json | ||
| - | |||
| - | # Needed to read CLI parameters | ||
| - | import sys | ||
| - | |||
| - | # Needed to check the valid domain name regex | ||
| - | import re | ||
| - | |||
| - | # Needed to manipulate the data | ||
| - | from datetime import datetime | ||
| - | |||
| - | |||
| - | APIKEY = " | ||
| - | |||
| - | |||
| - | def is_valid_domain_name(domain_name): | ||
| - | # Regular expression pattern to match a valid domain name | ||
| - | pattern = r" | ||
| - | |||
| - | # Check if the domain name matches the pattern | ||
| - | if re.match(pattern, | ||
| - | return True | ||
| - | else: | ||
| - | return False | ||
| - | |||
| - | def is_date_in_future(date_str): | ||
| - | current_date = datetime.now().date() | ||
| - | date = datetime.strptime(date_str, | ||
| - | |||
| - | if date > current_date: | ||
| - | return True | ||
| - | else: | ||
| - | return False | ||
| - | |||
| - | if len(sys.argv) < 1: | ||
| - | print(" | ||
| - | sys.exit(1) | ||
| - | |||
| - | parameter1 = sys.argv[1] | ||
| - | |||
| - | if not is_valid_domain_name(parameter1): | ||
| - | print(" | ||
| - | sys.exit(1) | ||
| - | |||
| - | |||
| - | DATA = " | ||
| - | |||
| - | # Make the cURL request | ||
| - | url = " | ||
| - | headers = { | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | response = requests.post(url, | ||
| - | |||
| - | # Check if the request was successful (status code 200) | ||
| - | if response.status_code == 200: | ||
| - | data = response.json() | ||
| - | results = data[" | ||
| - | for result in results: | ||
| - | records = result[' | ||
| - | if len(records) == 0: | ||
| - | print(" | ||
| - | else: | ||
| - | print(" | ||
| - | for record in records: | ||
| - | feed_name = record[" | ||
| - | feed_name = feed_name.ljust(27) | ||
| - | class_name = record[" | ||
| - | properties = record[" | ||
| - | detected = record[" | ||
| - | expiration = record[" | ||
| - | detected = datetime.strptime(detected, | ||
| - | detected = detected.strftime(" | ||
| - | expiration = datetime.strptime(expiration, | ||
| - | expiration = expiration.strftime(" | ||
| - | result = is_date_in_future(expiration) | ||
| - | if result is True: | ||
| - | active = " | ||
| - | else: | ||
| - | active = " | ||
| - | |||
| - | print(feed_name," | ||
| - | |||
| - | else: | ||
| - | print(" | ||
| - | |||
| - | DATA = " | ||
| - | |||
| - | # Make the cURL request | ||
| - | url = " | ||
| - | headers = { | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | response = requests.post(url, | ||
| - | |||
| - | |||
| - | |||
| - | # Check if the request was successful (status code 200) | ||
| - | if response.status_code == 200: | ||
| - | data = response.json() | ||
| - | results = data[" | ||
| - | print("" | ||
| - | for result in results: | ||
| - | records = result[' | ||
| - | if len(records) == 0: | ||
| - | print(" | ||
| - | else: | ||
| - | for record in records: | ||
| - | cat_name = record[" | ||
| - | print(" | ||
| - | |||
| - | else: | ||
| - | print(" | ||
| - | |||
| - | |||
| - | DATA = " | ||
| - | |||
| - | # Make the cURL request | ||
| - | url = " | ||
| - | headers = { | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | response = requests.post(url, | ||
| - | |||
| - | |||
| - | |||
| - | # Check if the request was successful (status code 200) | ||
| - | if response.status_code == 200: | ||
| - | data = response.json() | ||
| - | results = data[' | ||
| - | print("" | ||
| - | if len(results) == 0: | ||
| - | print(" | ||
| - | else: | ||
| - | print(" | ||
| - | print(" | ||
| - | |||
| - | for result in results: | ||
| - | # Keep this IF statement if you only want to inlucde Infoblox data and not SURBL or FARSIGHT | ||
| - | var_profile = " | ||
| - | var_confidence = " | ||
| - | var_expiration = " | ||
| - | var_full_profile = " | ||
| - | var_property = " | ||
| - | var_threat_level = " | ||
| - | var_confidence_score_rating = " | ||
| - | var_risk_score_rating = " | ||
| - | var_threat_score_rating = " | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | if ' | ||
| - | var_profile = result[' | ||
| - | if ' | ||
| - | var_confidence = result[' | ||
| - | if ' | ||
| - | var_expiration = result[' | ||
| - | var_expiration = datetime.strptime(var_expiration, | ||
| - | var_expiration = var_expiration.strftime(" | ||
| - | dateres = is_date_in_future(var_expiration) | ||
| - | if dateres is False: | ||
| - | var_expiration = " | ||
| - | if ' | ||
| - | var_full_profile = result[' | ||
| - | if ' | ||
| - | var_property = result[' | ||
| - | if len(var_property) < 22: | ||
| - | var_property += " | ||
| - | if ' | ||
| - | var_threat_level = result[' | ||
| - | if ' | ||
| - | var_confidence_score_rating = result[' | ||
| - | if ' | ||
| - | var_risk_score_rating = result[' | ||
| - | if ' | ||
| - | var_threat_score_rating = result[' | ||
| - | |||
| - | |||
| - | if result[' | ||
| - | if var_expiration != ' | ||
| - | print(var_full_profile," | ||
| - | |||
| - | |||
| - | else: | ||
| - | print(" | ||
| - | </ | ||
infoblox/tide.1700136945.txt.gz · Last modified: by bstafford