Contents

• About extensions

• Choose the correct version for your Intelligence Center

  • About extension versioning

  • About extension version checking

• Download extensions

• Install extensions

  • Switch user

  • Activate a virtual environment

  • Install the extension

  • Load the fixtures

  • Restart Intelligence Center services

  • Restart Intelligence Center workers

• Remove extensions

• Create custom extensions with the SDK

• API endpoints

About extensions

EclecticIQ Intelligence Center ships with a set of built-in extensions, such as feeds and enrichers. They expand Intelligence Center functionality by enabling interoperability with external systems, intelligence providers, and data sources.

You can download and install more extensions to add incoming and outgoing feed transport and content types, as well as enrichers.

This modular approach allows implementing as many, or as few, integrations as needed, based on your organization requirements and goals.

You can download extensions to add more feeds and enrichers to the Intelligence Center from https://downloads.eclecticiq.com/Extensions/.

By default, EclecticIQ Intelligence Center ships with all supported extensions preinstalled:

• Enrichers

• Incoming feeds

• Outgoing feeds

After installing and setting up a Intelligence Center instance, you may want to customize extensions, remove unnecessary ones, add new ones, and maybe reinstall previously removed ones:

• Download extensions

• Install extensions

• Remove extensions

Choose the correct version for your Intelligence Center

Download extensions

1. Go to the EclecticIQ Intelligence Center extensions repository at https://downloads.eclecticiq.com/Extensions/.

2. Browse to the extension you want to install, and click its name.

3. In the extension view, in the General tab, under Versions, click an extension version number to go to the corresponding section.

4. In the extension version view, in the General tab, under Downloads, click the extension package name to download it.

   Alternatively:

   1. Click the Files tab header.

   2. In the Files tab, click the desired extension package name to download it.

5. Save the extension package to a local directory.

Extension package names use the following format: eclecticiq-extension-{extension_name}-{platform_release}.tar.gz

Example:

• eclecticiq-extension-anubis-1.0.0.0.tar.gz: Anubis Cyberfeed incoming feed for EclecticIQ Intelligence Center release 1.14.x.

• eclecticiq-extension-anubis-2.2.0.0.tar.gz: Anubis Cyberfeed incoming feed for EclecticIQ Intelligence Center release 2.2.x.

Install extensions

Remove extensions

You may need to remove an extension for several reasons: to upgrade it to a newer release, to reinstall it in order to address functionality issues, or because you do not need it any longer.

To remove an extension:

1. Run the standard pip uninstall command.

2. Specify only the name of the extension, without Intelligence Center release number, and without extension archive file type:

   pip uninstall eclecticiq-extension-${extension-name}

    

   # Example: uninstall eclecticiq-extension-arcsight-2.0.tar.gz

   pip uninstall eclecticiq-extension-arcsight

Extension naming cheatsheet

Create custom extensions with the SDK

You can extend EclecticIQ Intelligence Center functionality — for example, by integrating the Intelligence Center with an external system such as a SIEM, or by hooking it up to a custom intel provider service.

EclecticIQ Intelligence Center SDK is the companion development kit to create integration extensions, such as feeds and enrichers.

The SDK provides a structured framework to build your extensions, to implement transport and content types for custom feeds, as well as to create new enrichers, based on your organization needs and requirements.

The SDK includes documentation and examples to help you along the way.

The documentation is included in the downloadable SDK archive file.

To request a download link to the SDK, open a support request ticket, or contact our support team.

To open it the SDK package and to access the dcumentation:

1. Decompress the SDK archive to a local working directory.

2. Browse to the /docs sub-directory.

3. Open the index.html index file in a web browser to access the SDK documentation and the main navigation.

In the /examples sub-directory you can find reference examples of:

• A transformer,that is, a content type parser

• A provider, that is, a transport type handler

• An enricher.

When you create a custom transformer to parse an input content type to JSON for ingestion into the Intelligence Center, stress-test it to gauge its ingestion limit.

For example, ingesting a package containing 10,000 entities may slow down the process to a crawl.

Therefore, it is a good practice to feed transformers packages containing less than 10,000 entities.

API endpoints

EclecticIQ Intelligence Center includes a public API with a number of endpoints exposing services such as the authentication mechanism, as well as access to the Intelligence Center assets and resources, such as entities, observables, enrichment tasks, and data sources.

The API accepts JSON requests and it returns JSON responses in UTF-8 encoding:

The authentication mechanism is based on JWT (JSON Web Tokens).

The public API methods and their arguments are documented, and you can familiarize yourself with the API calls and responses in a safe playground.

To access it, sing in to the Intelligence Center, and then append /private/static/swagger/ to your Intelligence Center instance base URL.

Example

This overview sums up the public API endpoints for reference: