Incoming feed - Kaspersky Threat Intelligence#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

Specifications

Transport type

Kaspersky Threat Intelligence Data Feeds

Content type

Kaspersky JSON

Ingested data

JSON.

Processed data

Consists of Indicators, TTPs (Malware Variants, Attack Patterns), observables and it sets relationships where applicable.

Description

This integration enables the Threat Intelligence Analyst to leverage a wealth of Threat Intelligence data, including TTPs, indicators and observables (via the URL and IP Address feeds) within multiple categories of interest, such as ransomware, phishing, malicious URLs, IP reputation, malicious files and trojans for mobile, and botnet.

Requirements#

Kaspersky Threat Intelligence Data Feeds is compatible with EclecticIQ Platform release 2.3.0 and later.

Users need a certificate issued from Kaspersky.

Limitations#

  • This incoming feed covers 9 feeds for Kaspersky Threat Intelligence Data Feeds, but access to them is determined/limited by the certificate issued from Kaspersky. This means that this feed will download and process the feeds it has access to and skip the others.

  • The feeds are big, so processing them can take some time.

  • This feed only provides information about active threats; there is no historical data in it. Therefore, this feed does not support backdating the start of the feed by defining a Start ingesting from date (as most other feeds do). It will only ever ingest packages offered on the feed after you create it.

Configure the incoming feed#

  1. Create or edit an incoming feed.

  2. From the Transport type drop-down menu, select Kaspersky Threat Intelligence Data Feeds.

  3. From the Content type drop-down menu, select Kaspersky JSON.

  4. The API URL field is automatically filled in with the default domain for the endpoint. You can add a proxy or set up ports according to your needs.

    Default value: https://wlinfo.kaspersky.com/api/v1.0/.

  5. The SSL verification checkbox is automatically selected.

  6. In the Path to SSL certificate field, enter the path to your PEM file.

    You may need to generate a PEM file from the file Kaspersky provides. Use the command below to convert the PFX file provided by Kaspersky into a PEM file. This command may require a password — you can find the password file and the PFX file in the bundle provided by the customer.

    Note: This may require a different certificate than the Report feeds (and vice versa for other feeds).

   openssl pkcs12 -in <your_pfx_file.pfx> -clcerts -out <output_file_name>.pem -nodes -legacy

  1. To store your changes, click Save; to discard them, click Cancel.

Additional information#

When the feed is run, three API calls are made in the background:

  1. The first call gets the list of available feeds that are supported.

  2. The next call extracts the link used in the third call.

  3. The third call downloads the zipped JSON file.

There are 9 feeds available:

  1. Malicious Hash Data Feed (66)

  2. Mobile Malicious Hash Data Feed (67)

  3. IP Reputation Data Feed (68)

  4. Mobile Botnet Data Feed (139)

  5. P-SMS Trojan Data Feed (73)

  6. Ransomware URL Data Feed (99)

  7. Botnet C&C URL Exact Data Feed (115)

  8. Phishing URL Exact Data Feed (116)

  9. Malicious URL Exact Data Feed (117)

Processing time of the Exact feeds (115, 116, and 117) is longer, as those feeds are bigger in size: instead of a single mask that covers a whole family of IOCs, they contain exact data.

We also cover 3 demo feeds:

  1. Demo Botnet C&C URL Data Feed (85)

  2. Demo Malicious Hash Data Feed (86)

  3. Demo IP Reputation Data Feed (87)

Test the feed#

  1. In the top navigation bar, click Data Configuration > Incoming feeds.

  2. Click the feed that you just created, using the steps above.

  3. In the Overview view, click Download now.

  4. Click Ingested entities and check that entities have been ingested into the platform.

Or:

  1. In the top navigation bar, click Intelligence > All intelligence > Browse.

  2. Click the Entities tab.

  3. In the top-left corner, click Filter.

  4. From the Source drop-down menu, select the incoming feed you just created, using the steps above.

  5. You can also filter by entity type: from the Entity drop-down menu, select the entity types you want to include in the filtered results.