semvec/pypi-packages huggingface dataset:
threatbus-cif3 2022.5.16
A plugin to enable indicators to be submitted to CIFv3 in real-time
License: BSD 3-clause
Requires Python: >=3.6
Keywords: cif,cifv3,cif3,renisac,ren-isac,threatbus,Threat Bus,threat intelligence,TI,TI dissemination

Threat Bus CIFv3 Plugin
======================

<h4 align="center">

[![PyPI Status][pypi-badge]][pypi-url]
[![Build Status][ci-badge]][ci-url]
[![License][license-badge]][license-url]

</h4>

A Threat Bus plugin to push indicators from Threat Bus to
[Collective Intelligence Framework v3](https://github.com/csirtgadgets/bearded-avenger).

The plugin uses the [cifsdk (v3.x)](https://pypi.org/project/cifsdk/) Python
client to submit indicators received from Threat Bus into a CIFv3 instance.

The plugin breaks with the pub/sub architecture of Threat Bus, because CIF does
not subscribe itself to the bus. Instead, the plugin actively contacts a CIF
endpoint.

## Installation

```sh
pip install threatbus-cif3
```

## Configuration

Configure this plugin by adding a section to Threat Bus' `config.yaml` file, as
follows:

```yaml
...
plugins:
  cif3:
    api:
      host: http://cif.host.tld:5000
      ssl: false
      token: CIF_TOKEN
    group: everyone
    confidence: 7.5
    tlp: amber
    tags:
      - test
      - malicious
...
```

## Development Setup

The following guides describe how to set up local, dockerized instances of CIF.

### Dockerized CIFv3

Use [dockerized CIFv3](https://github.com/sfinlon/cif-docker) to set
up a local CIFv3 environment:

*Setup a CIFv3 docker container*

```sh
git clone https://github.com/sfinlon/cif-docker.git
cd cif-docker
docker-compose build
```

*Edit the docker-compose.yml*

```sh
vim docker-compose.yml
```
Find the section `cif` in the configuration and edit the following as
appropriate to bind port 5000 to your localhost:

```yaml
cif:
    ...
    ports:
      - "5000:5000"
    ...
```


*Start the container*

```sh
docker-compose up -d
# Get an interactive shell in the container:
docker-compose exec cif /bin/bash
# Become the cif user:
su cif
# check to see if access tokens were successfully created. Copy the `admin`
# token to the CIF config section:
cif-tokens
# Ping the router to ensure connectivity:
cif --ping
```

## License

Threat Bus comes with a [3-clause BSD license][license-url].

[pypi-badge]: https://img.shields.io/pypi/v/threatbus-cif3.svg
[pypi-url]: https://pypi.org/project/threatbus-cif3
[ci-url]: https://github.com/tenzir/threatbus/actions?query=branch%3Amaster
[ci-badge]: https://github.com/tenzir/threatbus/workflows/Python%20Egg/badge.svg?branch=master
[license-badge]: https://img.shields.io/badge/license-BSD-blue.svg
[license-url]: https://github.com/tenzir/threatbus/blob/master/COPYING
threatbus-zeek 2022.5.16
A plugin to enable threatbus communication with Zeek network monitor.
License: BSD 3-clause
Requires Python: >=3.7
Keywords: Zeek,intrusion detection,IDS,broker,NSM,network security monitoring,threatbus,Threat Bus,threat intelligence,TI,TI dissemination

Threat Bus Zeek Plugin
======================

<h4 align="center">

[![PyPI Status][pypi-badge]][pypi-url]
[![Build Status][ci-badge]][ci-url]
[![License][license-badge]][license-url]

</h4>

A Threat Bus plugin that enables communication to [Zeek](https://zeek.org/).

## Installation

```sh
pip install threatbus-zeek
```

#### Prerequisites

*Install [Broker](https://github.com/zeek/broker) on the Threat Bus host*

The plugin uses the [Broker python bindings](https://docs.zeek.org/projects/broker/en/stable/python.html)
to enable communication with Zeek. You have to install Broker and bindings to
use this plugin.

## Configuration

The plugin starts a listening Broker endpoint. The endpoint characteristics for
listening can be cofigure as follows:

```yaml
...
plugins:
  apps:
    zeek:
      host: "127.0.0.1"
      port: 47761
      module_namespace: Tenzir
...
```

## Threat Bus Zeek Script

Threat Bus is a pub/sub broker for threat intelligence data. Applications, like
Zeek, have to register themselves at the bus. Hence, load this [Zeek script](https://github.com/tenzir/threatbus/blob/master/apps/zeek/threatbus.zeek)
into your Zeek installation to make it aware of Threat Bus.

The script can be configured via certain `option`s for setting topic names or
requesting an intel snapshot:

```sh
zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek -- "Tenzir::snapshot_intel=-30 days"
```

## License

Threat Bus comes with a [3-clause BSD license][license-url].

[pypi-badge]: https://img.shields.io/pypi/v/threatbus-zeek.svg
[pypi-url]: https://pypi.org/project/threatbus-zeek
[ci-url]: https://github.com/tenzir/threatbus/actions?query=branch%3Amaster
[ci-badge]: https://github.com/tenzir/threatbus/workflows/Python%20Egg/badge.svg?branch=master
[license-badge]: https://img.shields.io/badge/license-BSD-blue.svg
[license-url]: https://github.com/tenzir/threatbus/blob/master/COPYING
threatbus-rabbitmq 2022.5.16
A RabbitMQ backbone for threatbus.
License: BSD 3-clause
Requires Python: >=3.7
Keywords: message broker,rabbitmq,rabbit,mq,threatbus,Threat Bus,threat intelligence,TI,TI dissemination

Threat Bus RabbitMQ Backbone Plugin
===================================

<h4 align="center">

[![PyPI Status][pypi-badge]][pypi-url]
[![Build Status][ci-badge]][ci-url]
[![License][license-badge]][license-url]

</h4>

A Threat Bus plugin to use RabbitMQ as message broker backbone.

### RabbitMQ Properties

The plugin declares one fanout exchange with a configurable name and binds a
single queue to it. Messages are all routed via that exchange. Multiple Threat
Bus instances can bind to it, but per convention must use unique queue names.
The queue name will be `threatbus.<hostname>` where `<hostname>` is the
hostname of the machine running Threat Bus. You can overwrite this behavior in
the configuration file.

Messages sent over RabbitMQ are all serialized JSON. Each object must specify a
`type` field. Serialization, e.g., to STIX-2 objects or to Threat Bus internal
data types, is implemented based on the `type` field.

### Subscriptions

Application plugins can subscribe to topics and topic prefixes.

## Installation

```sh
pip install threatbus-rabbitmq
```

## Configuration

The plugin requires a RabbitMQ endpoint to start. You can configure endpoint
details in the plugin configuration of the Threat Bus `config.yaml`. You can
fine-tune resource behavior with the `queue` section of the config. 

```yaml
...
plugins:
  backbones:
    rabbitmq:
      host: localhost
      port: 5672
      username: guest
      password: guest
      vhost: /
      exchange_name: threatbus
      queue:
        name_suffix: "my_suffix" # this defaults to 'hostname' if left blank
        name_join_symbol: . # queue will be named "threatbus" + join_symbol + name_suffix
        durable: true
        auto_delete: false
        lazy: true
        exclusive: false
        max_items: 100000 # optional. remove property / set to 0 to allow infinite length
...
```


## License

Threat Bus comes with a [3-clause BSD license][license-url].

[pypi-badge]: https://img.shields.io/pypi/v/threatbus-rabbitmq.svg
[pypi-url]: https://pypi.org/project/threatbus-rabbitmq
[ci-url]: https://github.com/tenzir/threatbus/actions?query=branch%3Amaster
[ci-badge]: https://github.com/tenzir/threatbus/workflows/Python%20Egg/badge.svg?branch=master
[license-badge]: https://img.shields.io/badge/license-BSD-blue.svg
[license-url]: https://github.com/tenzir/threatbus/blob/master/COPYING
threatbus-inmem 2022.5.16
A simplistic in-memory backbone for threatbus.
License: BSD 3-clause
Requires Python: >=3.7
Keywords: message broker,threatbus,Threat Bus,threat intelligence,TI,TI dissemination

Threat Bus In-Memory Backbone Plugin
====================================

<h4 align="center">

[![PyPI Status][pypi-badge]][pypi-url]
[![Build Status][ci-badge]][ci-url]
[![License][license-badge]][license-url]

</h4>

A very simplistic Threat Bus plugin that provides an in-memory backbone for data
provisioning.

### Message Routing

Messages are routed based on their data type. Stix2 data, like Indicators and
Sightings are routed via the `stix2/` topic prefix. Threat Bus-internal messages
like SnapshotRequests and SnapshotEnvelopes are routed via the `threatbus/`
topic prefix.


### Subscriptions

Application plugins can subscribe to topics and topic prefixes.

## Installation

```sh
pip install threatbus-inmem
```

## Configuration

Add a placeholder for this plugin's config:

```yaml
...
plugins:
  backbones:
    inmem:
...
```

There is no further configuration needed.


## License

Threat Bus comes with a [3-clause BSD license][license-url].

[pypi-badge]: https://img.shields.io/pypi/v/threatbus-inmem.svg
[pypi-url]: https://pypi.org/project/threatbus-inmem
[ci-url]: https://github.com/tenzir/threatbus/actions?query=branch%3Amaster
[ci-badge]: https://github.com/tenzir/threatbus/workflows/Python%20Egg/badge.svg?branch=master
[license-badge]: https://img.shields.io/badge/license-BSD-blue.svg
[license-url]: https://github.com/tenzir/threatbus/blob/master/COPYING
suricata-threatbus 2022.5.16
A simple ZMQ app to connect to Threat Bus and ingest indicators as Suricata rules via `suricatasc`
License: BSD 3-clause
Requires Python: >=3.7
Keywords: open source,Suricata,suricatasc,IDS rules,threatbus,Threat Bus,threat intelligence,TI,TI dissemination

Suricata Threat Bus App
=======================

Threat Bus is a publish-subscribe broker for threat intelligence. It is expected
that applications register themselves at the bus. Since Suricata can't do that
on it's own (yet) this app works as a bridge application in the meantime.

It receives indicators from Threat Bus and picks up all those where the STIX-2
`pattern_type` equals `"suricata"`. The suricata rules from those IoCs are then
forwarded to Suricata using a pre-configured rules file and then reloaded via
[suricatasc](https://suricata.readthedocs.io/en/latest/manpages/suricatasc.html).

Make sure to run this app on the same host as your Suricata installation.
Make also sure that this app (e.g., user running this app) has the correct
permissions to use the `suricatasc` command line utility and can read/write the
rules file.

Received rule updates are not applied instantaneously to minimize load on
Suricata. Instead, users must configure the `reload_interval` (seconds) in the
config file to enable periodic reloads for Suricata to pick up rule changes.

## Quick Start

You can configure the app via a YAML configuration file. See
`config.yaml.example` for an example config file. Rename the example to
`config.yaml` before starting.

Alternatively, configure the app via environment variables, similarly to Threat
Bus, or pass a path to configuration file via `-c /path/to/config.yaml`.

Install `suricata-threatbus` in a virtualenv and start:

```sh
python -m venv venv
source venv/bin/activate
make dev-mode
suricata-threatbus
```

You first need to configure the `rules_file` option in the config file. See also
below for configuring your local Suricata installation to work with this app.

### Suricata Preparation

This app maintains a file with Suricata rules. The app writes to it and Suricata
reads from it. You need to make this file known to your Suricata installation by
adding it to the rules configuration section in the `suricata.yaml` config file.
Suricata won't pick up rule changes if you skip this step.

Here is an example snippet to add to your Suricata config file:

```
/etc/suricata/suricata.yaml
--------------------------------------------------------------------------------

....

default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - threatbus.rules         # !! managed by suricata-threatbus

....
```

In this example, we configure Suricata to read additional rules from a file
called `threatbus.rules`, located in the default rule path
`/var/lib/suricata/rules`.

You need to provide the path of your custom rule file to this app, so it can
modify the file contents when new indicators arrive. See also the `rules_file`
config option in the `config.yaml.example` file.