Package: act-workers
ACT WorkersIntroductionThis repository contains workers for theACT platform.The source code the workers are available ongithub.Changelog2.0.0Configuration is moved from~/.config/actworkers/actworkers.inito~/.config/act/act.iniThe old scio worker is removed and the new scio-worker (act-scio2) is renamed to act-scioSetupTo use the workers, install from PyPi:sudopip3installact-workersThis will install scripts for all workers:act-argus-caseact-attackact-country-regionsact-fact-chain-helper (see usage below)act-feedact-ip-filteract-misp-feedsact-mnemonic-pdnsact-scioact-search-graphact-shadowserver-asnact-uploaderact-url-shorter-unpackact-ta-helper (see usage below)act-verisact-vtOriginsAll workers support the optional arguments --origin-name and --origin-id. If they are not specified, facts will be added with the origin of the user performing the upload to the platform.For managing origins, use the toolact-origininact-adminpackage on pypi.Access modeBy default, all facts will have access-mode "RoleBased", which means that the user needs access to the organization specified when creating the facts.The access mode can be explicit set with--access-mode, e.g. like this, to set all facts to Public access mode:--access-mode PublicThere are also some workers, e.g.act-scioandact-mnemoninc-pdnsthat will set access-mode based on the input document (TLP green/white -> access-mode=Public), unless you explicit configures it to not do so.OrganizationAll workers support the optional arguments--organizationIf they are not specified, facts will be added with the organization of the origin or the user performing the upload to the platform (if not set by the origin.Worker usageTo print facts to stdout:$act-country-regions{"type":"memberOf","value":"","accessMode":"Public","sourceObject":{"type":"country","value":"Afghanistan"},"destinationObject":{"type":"subRegion","value":"Southern Asia"},"bidirectionalBinding":false}{"type":"memberOf","value":"","accessMode":"Public","sourceObject":{"type":"subRegion","value":"Southern Asia"},"destinationObject":{"type":"region","value":"Asia"},"bidirectionalBinding":false}(...)Or print facts as text representation:$act-country-regions--output-formatstr(country/Afghanistan)-[memberOf]->(subRegion/SouthernAsia)(subRegion/SouthernAsia)-[memberOf]->(region/Asia)(...)To add facts directly to the platform, include the act-baseurl and user-id options:$act-country-regions--act-baseurlhttp://localhost:8888--user-id1ConfigurationAll workers support options specified as command line arguments, environment variables and in a configuration file.A utility to show and start with a default ini file is also included:act-worker-config--help
usage:ACTworkerconfig[-h]{show,user,system}positionalarguments:{show,user,system}optionalarguments:-h,--helpshowthishelpmessageandexitshow-Printdefaultconfiguser-Copydefaultconfigto/home/fredrikb/.config/actworkers/actworkers.inisystem-Copydefaultconfigto/etc/actworkers.iniYou can see the default options inact/workers/etc/actworkers.ini.The configuration presedence are (from lowest to highest):Defaults (shown in --help for each worker)INI fileEnvironment variableCommand line argumentINI-fileArguments are parsed in two phases. First, it will look for the argument --config argument
which can be used to specify an alternative location for the ini file. If not --config argument
is given it will look for an ini file in the following locations:/etc/<CONFIG_FILE_NAME>
~/.config/<CONFIG_ID>/<CONFIG_FILE_NAME> (or directory specified by $XDG_CONFIG_HOME)The ini file contains a "[DEFAULT]" section that will be used for all workers.
In addition there are separate sections for each worker which you can use to configure
worker-specific options, and override default options.Environment variablesThe configuration step will also look for environment variables in uppercase and
with "-" replaced with "_". For the example for the option "cert-file" it will look for the
enviornment variable "$CERT_FILE".RequirementsAll workers requires python version >= 3.5 and the act-api library:act-api(act-api onpypi)In addition some of the libraries might have additional requirements. See requirements.txt for a full list of all requirements.Proxy configurationWorkers will honor theproxy-stringoption on the command line when connecting to external APIs. However, if you need to
use the proxy to connect to the ACT platform (--act-baseurl), you will need to add the "--proxy-platform" switch:echo-nwww.mnemonic.no|act-vt--proxy-string<PROXY>--user-id<USER-ID>--act-baseurl<ACT-HOST>--proxy-platformLocal developmentUse pip to install inlocal development mode. act-workers (and act-api) uses namespacing, so it is not compatible with usingsetup.py installorsetup.py develop.In repository, run:pip3install--user-e.searchA worker to run graph queries is also included. A sample search config is inscluded inetc/searc_jobs.ini:act-search-graphetc/search_jobs.iniact-feedact-feedcan be used to download feed bundles from a remote uri. Feed uri must have a file, manifest.json, that lists all bundle files that can be download by the feed worker:{"bundles":{"000bd93b8ce1fa2acfa448fa916083d76e64b008e336d6f54ad89f12f4232dcf.gz":1636355543,"0598e898979bc851d58b440a3ea248fe64d9df4d2ab1665da3be73c6d13df411.gz":1636681082,"0c03f87d142345a1bbea0867c145608e70ab2c0ea8282b5e06833f5f2b0f5f04.gz":1636366321,},"updated":1636699081}A local cache will be stored stored to keep track of the last bundle download, so bundles will not be downloaded multiple times.You can either let act-feed download files to a local directory:act-feed--feed-urihttps://act.mnemonic.no/feed--dump-dir[path]output all facts to stdout:act-feed--feed-urihttps://act.mnemonic.no/feedor upload facts directory to the platformact-feed--feed-urihttps://act.mnemonic.no/feed--act-baseurl[platformUR]--user-id[USERID]act-fact-chain-helperThe act-fact-chain-helper is a utility that can be used to add facts chains based on known start and end nodes. This can be usefull when adding
information from reports where do not have all the information availiable to you.exampleWe know from a report that the threat actor APT 1 uses the tool Mimikatz$act-fact-chain-helper--output-formatstr--startthreatActor/apt1--endtool/mimikatz--avoidmentions--includecontent(incident/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])-[attributedTo]->(threatActor/apt1)(event/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])-[attributedTo]->(incident/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])(content/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])-[observedIn]->(event/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])(content/[placeholder[1194f1ba4ea8ded28250a0193327654e5ee305bce03741a3e6f183f03b5c6b35]])-[classifiedAs]->(tool/mimikatz)In this case we do need to hint at the tool that it should include the "content" object and avoid "mention" facts.The source and destination is interchangeable. In the example above, the fact chain created by swapping the source and destination is identical.by adding the--act-baseurloption, the data will be stored to the platform.The tool works by finding the shortest path though the datamodel. The options --avoid and --include will modify the cost of traversing certain nodes or edges. This tool is considered experimental.l.act-ta-helperYou can useact-ta-helperto create facts, including placeholders, for typical scenarios where you have some
information of TA activity, but not all.This worker should not be used if any of objects listed as placeholders below are known.--taTHREAT-ACTORThreatActorName(Required)--ta-located-inCOUNTRYCountrywherethreatactorislocated--campaignCAMPAIGNCampaign--techniquesTECHNIQUESListoftechniques(commaseparated).SupporttechniqueIDs,e.g.T1002andnamee.g"Valid Accounts"--toolsTOOLSListoftools(commaseparated)--sectorsSECTORSListofSectors(commaseparated)--target-countriesCOUNTRIESTargetCountries(commaseparated)You can run the tool with the options above, and add--output-format strto se a suggested list of facts.
You can then add--act-baseurland--user-idto add the facts to a platform instance.You can add all options on a single command line, like this example:act-ta-helper\--output-formatstr\--taHAFNIUM\--sectorspharmaceuticals,education,defense,non-profit\--toolsPsExec,Procdump,7-Zip,Nishang,PowerCat,WinRar,SIMPLESEESHARP,SPORTSBALL,ChinaChopper,ASPXSPY,Covenant\--target-countries"Denmark,United States of America"\--campaign"Operation Exchange Marauder"\--ta-located-inChina\--techniquesT1588,T1003,T1190,T1560,T1583,T1071,T1114,T1567,T1136,T1021The following facts/placeholders will be created based on the options (placeholders are marked with [*]):ta-located-inUse this if you know the threat actor name and country where TA is located, but organization is unknown.threatActor -[attributedTo]-> organization[*] -[locatedIn]-> countrycampaignUse this if you know the threat actor and campaign name, but incident is unknown.threatActor -[attributedTo]-> incident[*] -[attributedTo]-> campaigntechniquesUse this if you know the threat actor and technique, but event and incident is unknown.technique <-[classifiedAs]- event[*] -[attributedTo]-> incident[*] -[attributedTo]-> threatActortoolsUse if tool and threat actor is known, but incident, content and event is unknown.threatActor <-[attributedTo]- incident[*] <-[observedIn]- content[*] -[classifiedAs]-> toolsectorsUse this if threat actor and target sector is known, but organization and incident is unknown.threatActor -[attributedTo]-> incident[*] -[targets]-> organization[*] -[memberOf]-> sectortarget-countriesUse this if threat actor and target country is known, but organization and incident is unknown.threatActor -[attributedTo]-> incident[*] -[targets]-> organization[*] -[locatedIn]-> country