ArcSight CEF

The ArcSight CEF content type is suitable for machine consumption.

Typical use cases include feeding an ArcSight CEF outgoing feed to a SIEM system such as ArcSight ESM or to a Syslog server for further processing.

The ArcSight CEF content type does not have any specific configuration parameters.

EclecticIQ Entities CSV

The EclecticIQ Entities CSV content type outputs CSV files with column headers where each row holds data describing one entity.

The EclecticIQ Entities CSV content type enables comparing two different outputs from the same outgoing feed to diff them, and to examine any changes at entity-level.

This is a quick and inexpensive way to check for feed content changes and updates since the previous feed task run.

To do so, select Update strategy, and click Diff.

The EclecticIQ Entities CSV content type does not have any specific configuration parameters.

EclecticIQ Observables CSV

The EclecticIQ Observables CSV outgoing feed outputs CSV files with column headers where each row holds data describing one observable.

For example: an IP address, a hash, a geographic location name, and so on.

The EclecticIQ Observables CSV content type enables comparing two different outputs from the same outgoing feed to diff them, and to examine any changes at observable-level.

This is a quick and inexpensive way to check for feed content changes and updates since the previous feed task run.

To do so, select Update strategy, and click Diff.

The EclecticIQ Entities CSV content type does not have any specific configuration parameters.

EclecticIQ HTML Report

Creates a static HTML file for each Report entity in a dataset and makes them available through the outgoing feed.

Using the Send email transport type sends the HTML report as an email attachment.

For information on update strategies, see About outgoing feeds.

To configure the EclecticIQ HTML Report content type, fill out these fields under the Content configuration section when you set up your outgoing feed:

Image of sample HTML report

EclecticIQ HTML Report Digest

Creates a HTML digest that summarizes the Report entities that are included in a dataset, and makes it available through the outgoing feed.

Using the Send email transport type sends the HTML report as an email attachment.

For information on update strategies, see About outgoing feeds.

To configure the EclecticIQ HTML Report Digest content type, fill out these fields under the Content configuration section when you set up your outgoing feed:

Image of sample HTML digest report

EclecticIQ JSON

The EclecticIQ JSON content type is suitable for machine consumption.

For example, you can use EclecticIQ JSON as a content type in a platform-to-platform data exchange setup.

Under Content configuration, set the EclecticIQ JSON content type option:

1. Select the Override producer checkbox to replace the value defining the identity of the original producer of the data with the producer name defined for the platform.

   To find this value, click Settings ( ) > STIX and TAXII > STIX > Add STIX settings > Producer.

   Leave it deselected to include the identity of the original producer of the information.

   This setting affects the data.producer.identity.name value in the entity JSON entity data structure:

   {
     "data": {
       "producer": {
         "type": "information-source",
         "identity": {
           "type": "identity"
           "name": "${producer_identity}", // ex.:'EclecticIQ'
   
         }
       }
     }
   }

PAN-OS external Dynamic List

Configure PAN-OS External Dynamic List

1. Go to the Transport and content section, and from the Content type drop-down menu, select PAN-OS External Dynamic List.

2. Go to the Content configuration section, and from the Palo Alto PAN-OS External Dynamic List drop-down menu, select type of list you want to publish through the outgoing feed:

   • PAN-OS IP External Dynamic List: the feed outputs an IP address list to feed the Palo Alto firewall with, so that the firewall blocks the included IP addresses.

   • PAN-OS Domain External Dynamic List: the feed outputs a domain name list to feed the Palo Alto firewall with, so that the firewall blocks the included domain names.

   • PAN-OS URL External Dynamic List: the feed outputs a URL list to feed the Palo Alto firewall with, so that the firewall blocks the included URLs.

3. Go to the Transport configuration section, and set the appropriate transport type options for the selected transport type for the PAN-OS External Dynamic List content.

Supported External Dynamic List types

Palo Alto External Dynamic Lists (EDL) support IP addresses, domains, and URLs.

The external dynamic lists the platform published through the PAN-OS External Dynamic List outgoing feed support these list types:

192.168.20.10
2001:db8:123:1::1
8.8.8.8
192.168.20.10

www.instagram.com
malicious.com
abc.baddomain.cc

www.wellknownsite.com/bad-page
www.yahoo.com/search=*
www.facebook.com/messenger

Plain text value

The Plain text value content type is suitable for machine consumption.

Typical use cases include feeding a plain text value outgoing feed to an external compatible device to instrument further processing or to trigger a response action.

The Plain text value content configuration options set up a rule to identify matching data to include in the outgoing feed content.

The rule works like this:

1. “Check if this JSON field exists”: check if the JSON path defined in Field to check a conditional value in points to an existing entity field in the entity JSON structure.

2. “If the JSON field exists, check if its value matches this input”: if the JSON path defined in Field to check a conditional value in points to an existing entity JSON field, check if its value matches the input defined in Only use entities that match this conditional value.

3. “Check if this other JSON field exists. If it does, get its value and add it to the feed content”: if the JSON path defined in Field to check a conditional value in points to an existing entity JSON field, and if its value matches the input defined in Only use entities that match this conditional value, go to the JSON field defined in Field to take values from, and retrieve its value: this is what we want to include in the outgoing feed content.

Under Content configuration set the Plain text value content type options to define the rule behavior:

1. Field to check a conditional value in: this condition works together with Only use entities that match this conditional value to define the key/value pair the rule uses to filter specific entities.

   Enter a JSON path pointing to the JSON field of the entity type whose content you want to include for publication in the outgoing feed.

   • JSON paths are relative to the top-level data field. The the top-level data field is the implicit root of a JSON path.

     For example, to point to the title or to the description fields of an entity, specify title or description, instead of data.title or data.description.

   • JSON paths are strings pointing to specific JSON fields in a JSON data structure.

     They define locations in the entity structure where the rule looks for data values matching specified data patterns.

   • The JSON path format is a string where dots (.) define parent-child relationships in the JSON data structure.

     Do not include square brackets ([ ]) in the path input: they are stripped during execution.

     ..? so how do we deal with arrays/lists?

     Therefore, you cannot use square brackets to point to array members through their array index values.

2. Only use entities that match this conditional value: this condition works together with Field to check a conditional value in to define the key/value pair the rule uses to filter specific entities.

   Enter a string to define the value to match.

   Example: snort

   Allowed values:

   • Literal alphanumeric text input.

   • Regex data pattern.

     • The regex syntax this field accepts is the Elasticsearch regular expression syntax.

       The main peculiarities of the Elasticsearch DSL query syntax are:

       • Anchors – ^ and $ – are implied at the beginning and at the end of the regex.

         Do not include them in the regex pattern input.

       • If you insert explicit anchor characters in the value input field, they are interpreted as literal values.

       • Escape special characters:

         ( . ? + | { } [ ] ( ) " \ / )

         To escape a special characters, prepend a backslash \ to it.

         Example: \{ \}

         At the moment, Elasticsearch regular expression syntax optional operators are not supported.

         Although the regex syntax used in the UI of the platform is that of ElasticSearch, the regex syntax used by the platform’s ingestion engine is Python regex. In the vast majority of cases this does not lead to conflicts, but if your discovery rule is not working the way you want it to, this may be the reason.

         Here are two differences that commonly cause problems:

         • ElasticSearch searches for whole strings, while Python searches everywhere in a string. For example,

           Input: Cert-BUND

           Pattern: ert

           ES result: <none>

           Python: will match

         • ElasticSearch regex syntax requires you to leave out anchors, whereas Python regex syntax requires you to include them.

         If you are experiencing problems in this area, contact Customer Support for help in writing the discovery rule you want.

3. Field to take values from: defines the entity JSON field whose value you want to to add to the outgoing feed.

   Enter a JSON path pointing to the entity JSON field whose value you want to fetch and include for publication in the outgoing feed.

   • JSON paths are relative to the top-level data field. The the top-level data field is the implicit root of a JSON path.

     For example, to point to the title or to the description fields of an entity, specify title or description, instead of data.title or data.description.

   • JSON paths are strings pointing to specific JSON fields in a JSON data structure.

     They define locations in the entity structure where the rule looks for data values matching specified data patterns.

   • The JSON path format is a string where dots (.) define parent-child relationships in the JSON data structure.

     Do not include square brackets ([ ]) in the path input: they are stripped during execution.

     ..? so how do we deal with arrays/lists?

     Therefore, you cannot use square brackets to point to array members through their array index values.

Example

You can configure this rule to send relevant data to an external Snort or Suricata instance, where they can be further processed or used to initiate a specific response action:

• Field to check a conditional value in: data.test_mechanisms.test_mechanism_type

• Only use entities that match this conditional value: snort

• Field to take values from: data.test_mechanisms.rules.value

The rule uses these conditions to:

1. Look for platform entities containing Snort rules: data.test_mechanisms.test_mechanism_type: snort

2. If the previous condition yields matching entities, the rule looks in those entities to see if they contain this field: data.test_mechanisms.rules.value

3. If they do, the rule fetches the value stored in data.test_mechanisms.rules.value to include it in the outgoing feed content.

Retrieved values are added to the outgoing feed, one value per line.

The values in question should be valid Snort rules for the resulting outgoing feed content to be meaningful.

Example:

alert tcp $HOME_NET any -> [72.20.35.70,72.20.35.120] 6661 (msg:\"ET CNC Shadowserver Reported CnC Server Port 6661 Group 1\"; flags:S; reference:url,doc.emergingthreats.net/bin/view/Main/BotCC; reference:url,www.shadowserver.org; threshold: type limit, track by_src, seconds 360, count 1; classtype:trojan-activity; flowbits:set,ET.Evil; flowbits:set,ET.BotccIP; sid:2405018; rev:3633;)

STIX 1.2

The STIX 1.2 content type is suitable for machine consumption.

Typical use cases include feeding a STIX 1.2-format outgoing feed to an external STIX-compatible device to instrument further processing or to trigger a response action.

Under Content configuration, do the following:

1. Select the Override producer checkbox to replace the original producer identity with the Producer name defined for the platform.

   You find this original identity by going to the left navigation bar, click ( ) > STIX and TAXII > STIX.

   You will find the original identity in the Producer field.

   Leave it deselected to include the original producer of the information.

   This setting changes the following nested XML element in the entity STIX structure:

       EclecticIQ

2. Select the Include EclecticIQ-specific STIX extensions checkbox to enable EclecticIQ STIX extensions for the entities and the observables included in the outgoing feed content.

   Leave the option deselected, unless the recipient of the feed content can correctly validate and parse STIX 1.2 content with EclecticIQ STIX extensions.

   Otherwise, integrations may break, and data exchange may fail.