Package: metemcyber
MetemcyberDecentralized Cyber Threat Intelligence Kaizen Framework.https://www.metemcyber.ntt.comPricom Mainnet (rpc.metemcyber.ntt.com)Contract NameAddressCTICatalog0xBcb4b84cdaB65C6e6Efe1697CC41a46D0AEaCA61CTIBroker0xC1814B834E1be7DeE7611fD5F747535369B8683eCTIOperator0x35b3fbeABB802E9477b17a63073ABe874A386E25metemcyber_util(placeholder)0x0e5EECFF51a3ab2221fF6bBd240B20E8933ff28A__$47ceb01e1c551398bb2e8f2c8232f40551$__💡 OverviewMetemcyber™ enables security collaboration and assessment all across the organization through theintelligence cycle.📖Metemcyber User Documentation✨ FeaturesAnyone can make a successful intelligence cycle.Content-oriented WorkflowComparable Data Analysis ProcessFault-tolerant CollaborationDisclosure Control of CTIsMeasuring the Cost-Effectiveness of CTIsTransparency for TrustMonitoring the trading activity of CTIsUnlocking achievements based on your contribution.MISP-friendly 🤗🚅 QuickStartThis exercise will be performed on the test environment.aptinstallbuild-essentialpython3-dev
pipinstall-Upip
pipinstall-U'metemcyber[cli]'Check the current configuration:metemctlconfigshow🔑 Create a new accountCreate a new account if no keyfile available:metemctlaccountcreateDisplay your account details you are currently using:metemctlaccountshow⚠️You must agree tothe terms of service.This is an experimental project on the enterprise ethereum of NTT Communications.You will get a promo code if you agree to these terms.Get a promo code via email, and airdrop yourself some ETH to get started:metemctlaccountairdrop$PROMOTE_CODE_IN_THE_CONFIRMATION_MAIL🛒 Collect CTIsSearch for the CTI token you want to buy (e.g. OSINT)metemctlixsearch'OSINT'Enter the index number of the CTI token to be purchased. The CTI token address can also be accepted.metemctlixbuy$TOKEN_INDEX_OR_ADDRESS⚠️You need an account to usengrok.Setup a local ngrok environment.
Downloadngrokand extract it.
Open the application directory toput the ngrok executable file there:metemctlopen-app-dir$ls"$(metemctlopen-app-dir--print-only)"external-links.jsonmetemctl.iningrok...Ngrok need to connect your ngrok account.Make sure the ngrokauthtokenexists afterngrok setup:cat~/.ngrok2/ngrok.ymlStart a daemon to receive data using ngrok:metemctlseekerstart--ngrok
metemctlseekerstatusUse CTI token to receive the MISP object on your public URL of the ngrok.metemctlixuse$TOKEN_INDEX_OR_ADDRESS♻️ Run the Intelligence CycleIn this section, you will run the intelligence cycle using the exerciseir-exercisefor Incident Response.⚠️You need to enable the test catalog as primary catalog.
Enable the test catalog & Disable the production catalog:metemctlixcatalogenable0x168DD95472cEaF5c28447C8b07A593e205E92A12# testmetemctlixcatalogdisable0xBcb4b84cdaB65C6e6Efe1697CC41a46D0AEaCA61# productionCheck your catalog settings:$metemctlixcatalogshow
Catalogs*:active*10x168DD95472cEaF5c28447C8b07A593e205E92A12# test20xBcb4b84cdaB65C6e6Efe1697CC41a46D0AEaCA61# production🤖 Create a new workflowMetemcyber can be used not only for CTI dissemination but also CTI creation.metemctlnew--starter=ir-exerciseImplement the analysis process into your workflow by selecting the event ID (In many cases, the same as the UUID of MISP object), the category of CTI (Fraud, Incident Response, Risk Analysis, Security Operations, Security Leadership, Vulnerability Management), and the content(IOCs, TTPs, etc.) you want to include in the CTI.This is an important piece of evidence to check the "Direction" step in the intelligence cycle.SelectIntelligenceCategory(Fraud,IR,RA,SecOps,SecLead,Vuln)[IR]:
Inputanewevent_id(UUID)[70be8ba5-fa7f-4b8e-aa04-dc76e0fa8c42]:0:IOC1:TTP2:Workflow
Choosecontentstobeinclude[0,1]:================================================================EventID:70be8ba5-fa7f-4b8e-aa04-dc76e0fa8c42
Category:IncidentResponse
Contents:['TTPs','IOCs']================================================================Areyousureyouwanttocreateit?[y/N]:📝 Summarize the data analysis process⚠️Make sure Seeker is runningto receive the data.metemctlseekerstatusYou need to useKedroto summarize your data analysis process into a workflow.In practice, it is difficult to clearly separate the steps of "Collection", "Processing" and "Analysis" in the intelligence cycle, which makes the data analysis process look complicated.Please keep the following two points to make the data analysis process more maintainable.Using the Kedro pipeline to describeAnalysis StrategyUsing the Kedro nodes to describeAnalysis MethodThese are important pieces of evidence to check the "Processing" and "Analysis" step in the intelligence cycle.For the success of the intelligence cycle, we are more focused on evaluating the data analysis process than on automating the CTI consumption process.Get data for the exerciseir-exercise:metemctlixsearch'[ir-exercise]'metemctlixbuy$TOKEN_INDEX_OR_ADDRESSmetemctlixuse$TOKEN_INDEX_OR_ADDRESSmetemctlixextract$TOKEN_INDEX_OR_ADDRESSRun the ir-exercise workflow:metemctlrun--setupCheck the contents of your CTI product and the workflow:metemctlcheck--vizThe--vizoption allows you to visualize your data analysis process described by the workflow. (the same askedro viz)🚀 Disseminate your CTI products to everyone:⚠️Solvermust be runningto send the data to token holders.metemctlsolverstart--enableMISP objects can be distributed when Solver is working properly.$metemctlsolverstatus
Solverrunningwithoperatoryouconfigured(0xe889b84a209719B8f0272376dB49946DbD177aE6).metemctlpublish🎉🎉🎉 Welcome to Metemcyber! 🎉🎉🎉📖 DocumentationFor more information see thedocumentation.⚖️ LICENSECopyright 2021 NTT Communications Corporation

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.