ThreatConnect TAXII Ingest User Guide

Overview

The ThreatConnect® TAXII™ Ingest App ingests Structured Threat Information eXpression (STIX™) 2.1 threat intelligence objects from TAXII feeds into ThreatConnect. STIX threat intelligence objects are mapped to ThreatConnect data model objects in one of three ways:

• Using a generic base mapping
• Using a mapping specific to a particular TAXII feed
• Using your own custom mapping

The ThreatConnect TAXII Ingest App creates the following object types from the STIX objects it ingests:

• Indicators: Address, ASN, CIDR, Email Address, Email Subject, File, Host, and URL
• Groups: Adversary, Campaign, Intrusion Set, Report, and Threat

The ThreatConnect TAXII Ingest App can ingest data from any TAXII feed. It supports mappings specific to the following TAXII feeds: AlienVault®, FS-ISAC®, H-ISAC®, ND-ISAC®, ReversingLabs™, Space-ISAC, and VMRay®.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with 7.9.0 or newer installed

Other Dependencies

• Running third-party (e.g., AlienVault, FS-ISAC) TAXII 2.1 server feed

Application Setup and Configuration

Follow these steps to install the ThreatConnect TAXII Ingest App via TC Exchange™ and configure it for a TAXII feed:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the ThreatConnect TAXII Ingest App on the Catalog tab. Then click Installin the Options column to install the App.
4. After you install the ThreatConnect TAXII Ingest App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the App for a single TAXII feed. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the ThreatConnect TAXII Ingest App for a TAXII feed.

ThreatConnect TAXII Ingest UI

After successfully configuring and activating the Feed API Service, you can access the ThreatConnect TAXII Ingest user interface (UI) for the TAXII feed. This UI allows you to interact with and manage the ThreatConnect TAXII Ingest App.

Follow these steps to access the ThreatConnect TAXII Ingest UI for a TAXII feed:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services.
3. Locate the ThreatConnect TAXII Ingest Feed API Service for the TAXII feed.
4. Click the link in the Service’s API Path field. The ThreatConnect TAXII Ingest UI will open in a new browser tab.

The following screens are available in the ThreatConnect TAXII Ingest UI:

• Dashboard
• Jobs
• Tasks
• Mappings
• Batch Errors 

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of Indicators, Groups, and Relationships ingested by the ThreatConnect TAXII Ingest App from the TAXII feed into ThreatConnect.

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of ThreatConnect TAXII Ingest data into manageable Job-like tasks, displaying all processes that are pending, in progress, complete, and failed. The ⋯ menu in a Job’s row provides the following options:

• Details: View details for the Job, such as download, convert, and upload start and complete times and counts of downloaded and batched Groups and Indicators.
• Download Files: Download metadata files for all Jobs and data (convert, download, and upload) files for completed Jobs.
• Batch Errors: View errors that have occurred for the Job on the Batch Errors screen.

You can filter ThreatConnect TAXII Ingest App Jobs by the following elements:

• Job ID: Enter text into this box to search for a Job by its Job ID.
• Job Type: Select Job types to display on the Jobs screen.
• Status: Select Job statuses to display on the Jobs screen.

Add a Job

You can add ad-hoc Jobs on the Jobs screen. Follow these steps to create a request for an ad-hoc Job for the ThreatConnect TAXII Ingest App:

1. Click the Add Job button at the upper right of the Jobs screen (Figure 2).
2. Fill out the fields on the Add Job drawer (Figure 3) as follows: 

    

   • Start Time: (Optional) Enter the time at which the Job should start.
   • End Time: (Optional) Enter the time by which the Job should end.
3. Click Submit to submit the request for the ad-hoc Job.

Tasks

The Tasks screen (Figure 4) displays all Tasks that may be part of a Job, including each step of the download, convert, and upload processes, as well as Tasks for the ThreatConnect TAXII Ingest App, such as Monitor, Scheduler, and Cleaner. The current status (Idle, Paused, or Running), name, description, and heartbeat timeout length, in minutes, are displayed for each Task. The ⋯ menu in a Task’s row provides the following options, depending on the Task’s status:

• Run (idle and paused Tasks only)
• Pause (idle and running Tasks only)
• Resume (paused Tasks only)
• Kill (running Tasks only)

Under the table is a dashboard where you can view runtime analytics.

Mappings

The Mappings screen (Figure 5) displays links to the mappings for the each of the TAXI feed’s object types.

Select an object type to view its mappings for fields, Attributes, Tags, and Security Labels and example STIX data in JavaScript® Object Notation (JSON) format (Figure 6). Expand a mapping’s row to view its type (Attributes only) and value (all mapping types).

Custom Mappings

The ThreatConnect TAXII Ingest App allows you to create custom mappings, providing flexibility and control over how data are ingested.

Follow these steps to add a custom mapping in the ThreatConnect TAXII Ingest App:

1. Click Add under the mapping type’s header (Attribute, Tag, and Security Label types), or select a Field from the Choose a field to add… dropdown and then click Add (Field type).
   Note

   If an object type does not support custom Fields, then the Choose a field to add… dropdown will be empty.
2. Enter the type (Attributes only) and value (all mapping types) for the custom mapping in the new row at the bottom of the table for the mapping type.
3. Click Confirmto save the custom mapping.
   Note

   You may edit and delete custom mappings. Read-only mappings may not be edited or deleted.

Batch Errors

The Batch Errors screen (Figure 7) displays an overview of the batch error types that have occurred for Job requests. You can enter keywords to filter by Job ID.

Click on an error type to open a drawer containing a table with details on all batch errors of that type (Figure 8). You can enter keywords to filter by reason for error.

Data Mappings

General Mappings

The data mappings in Table 2 through Table 11 illustrate how data are mapped from the STIX data model to the ThreatConnect data model.

Common Mapping

ThreatConnect object type: All ThreatConnect Group and Indicator object types

Attack Patterns

ThreatConnect object type: Attack Pattern Group

Campaigns

ThreatConnect object type: Campaign Group

Courses of Action

ThreatConnect object type: Course of Action Group

Intrusion Sets

ThreatConnect object type: Intrusion Set Group

Malware

ThreatConnect object type: Malware Group

Reports

ThreatConnect object type: Report Group

Signatures

ThreatConnect object type: Signature Group

Threat Actors

ThreatConnect object type: Adversary Group

Tools

ThreatConnect object type: Tool Group

Special Mappings

STIX Indicator Patterns

STIX Indicator patterns vary in complexity. Atomic indicators, like a single IP address or file hash, are simple and direct—they match a specific value and are easy to process. In contrast, complex patterns can involve multiple conditions, logical operators (e.g., AND, OR), temporal relationships (e.g., events happening within a time window), and behavioral indicators that describe how an attacker operates rather than what they use. The ThreatConnect TAXII Ingest App ingests atomic indicators as their corresponding ThreatConnect Indicator type. It ingests more complex patterns as Signature Groups of the STIX Pattern type.

STIX Relationships

STIX relationships are captured as object_refs on a STIX Report object and from STIX Relationship Objects (SROs). The ThreatConnect TAXII Ingest App creates these relationships as associations in ThreatConnect, including the following types of custom Indicator-to-Indicator associations:

• Address to Indicators
• Email Address to Indicators
• File to Indicators
• Host to Indicators
• URL to Indicators

ThreatConnect® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
AlienVault® is a registered trademark of AlienVault, Inc.
FS-ISAC® is a registered trademark of FS-ISAC, Inc.
STIX™ and TAXII™ are trademarks of The MITRE Corporation.
ND-ISAC® is a registered trademark of National Defense Information Sharing and Analysis Center.
H-ISAC® is a registered trademark of NH-ISAC, Inc.
JavaScript® is a registered trademark of Oracle Corporation.
ReversingLabs™ is a trademark of ReversingLabs International GmbH.
VMRay^® is a registered trademark of VMRay GmbH.

30092-01 EN Rev. A