Package: vast-threatbus
VAST Threat Bus AppThreat Bus is a publish-subscribe broker for threat intelligence. It is
expected that applications register themselves at the bus. Since VAST cannot do
so on its own (yet),vast-threatbus.pyimplements that functionality in the
meantime.The application provides a thin layer aroundPyVAST, VAST's Python
CLI bindings. It facilitates message exchange between Threat Bus and a VAST
instance.InstallationInstallvast-threatbusviapip. Optionally, use a virtual environment.virtualenv venv           # optional
source venv/bin/activate  # optional
python -m pip install vast-threatbusDevelopmentUse thedev-modecommand from theMakefileto install the project indevelopment mode.
We recommend to use a virtual environment for development.virtualenv venv
source venv/bin/activate
make dev-modeQuick StartYou can configure the app via a YAML configuration file. Seeconfig.yaml.examplefor an example config file that usesfever alertifyto transform sighting contexts
before they get printed toSTDOUT. See the sectionFeaturesfor details. Rename
the example toconfig.yamlbefore starting.Alternatively, configure the app via environment variables, similarly to Threat
Bus, or pass a path to configuration file via-c /path/to/config.yaml.Start the application:vast-threatbusDockerYou can also run this app via Docker.Build it:docker build . -t tenzir/vast-threatbus:latestRun it to print the helptext.docker run tenzir/vast-threatbus:latestRun and mount a custom config file into the container:docker run --net=host -v /path/to/your/conf.yaml:/opt/tenzir/threatbus/vast-threatbus/config.yaml tenzir/vast-threatbus:latest -c config.yamlFeaturesThis section explains the most important features ofvast-threatbus.IoC MatchingVASTcan match IoCs either live or
retrospectively via usual queries.Live MatchingVAST'slive matchingworks ascontinuous query.vast-threatbussubscribes to those continuous query results and reports all
new IoC matches from VAST to Threat Bus asSightings. You can enable live
matching in the config file by settinglive_match: true.Retro Matchingvast-threatbussupports retro matching. You can enable it in the config file
by settingretro_match: true. This instructs the application to translate IoCs
from Threat Bus to normal VAST queries instead of feeding the IoCs to a live
matcher.Each result from an IoC query is treated asSightingof that IoC and reported
back to Threat Bus. You can limit the maximum amount of results returned from
VAST by setting the config optionretro_match_max_eventsto a positive integer.Sighting Context TransformationYou can configurevast-threatbusto invoke another program for parsing
Sightingcontextdata via the config optiontransform_context.If set, the app translates thex_threatbus_sighting_contextfield of a STIX-2
Sighting via the specified utility. For example, configure the app to pass the
context object toDCSO/feveralertify:...transform_context:fever alertify --alert-prefix 'MY PREFIX' --extra-key my-ioc --ioc %ioc...Thex_threatbus_sighting_contextfield can contain arbitrary data. For
example, retro matches from VAST contain the full query result in the context
field (like a Suricata EVE entry or a Zeek conn.log entry).Note that thecmdstring passed totransform_contextis treated as
template string. The placeholder%iocis replaced with the contents of the
actually matched IoC.Custom Sinks for Sightingsvast-threatbusoffers to send Sighting context to a configurablesinkinsteadof reporting them back to Threat Bus. This can be configured via thesinkconfiguration parameter. The special placeholderSTDOUTcan be used to
print the Sighting context toSTDOUT.A custom sink is useful to forwardSightingsto another process, likesyslog, or forward STDOUT via a UNIX pipe. Note that it may be desirable to
disable logging in that case.Note that only thex_threatbus_sighting_contextfield of a STIX-2 Sighting is
printed, and not the object structure of the Sighting itself.