Skip to main content

Resilient Circuits Custom Threat Service

Project description

Resilient Lightweight Custom Threat Service

This package implements the Custom Threat Service API, providing a simple framework to develop threat source lookups in Python using the Resilient Circuits integration framework.

It's suitable for simple "lightweight" threat source lookups.

  • All lookups are asynchronous.
  • There is currently no support for file-attachment handling.
  • Queries are not stored persistently, so if you need to track external resources (for example, if your threat service starts a long-running task such as sandbox processing) those will not be tracked across restarts.

For more robust and advanced features, you should consider deploying a standalone threat service, for example based on the Django example (

What's new

v42 supports resutil threatserviceedit -user and -password authentication


This package requires that it is installed on a RHEL platform and that the resilient-circuits application is running. Install this package with 'pip', or python install. To set the config values in the app.config file run resilient-circuits config -u.

Config values example:


# Base URL for threat services API

# Whether we support file upload (for "file"-type artifacts)
# upload_file=False

# Retry time indicators

# Cache management

# use auth_user and auth_password when specifying the -user and -password parameters on
#  resutil threatserviceedit to ensure basic authentication

Run with: resilient-circuits run.

Custom Threat Service Example

This package includes an example threat service that responds to 'URL' artifacts with static data. To register the example onto your Resilient server (assuming that the resilient-circuits application is running on the same server):

sudo resutil threatserviceedit -name example -resturl
sudo resutil threatservicetest -name example

To delete,

sudo resutil threatservicedel -name example

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

rc-cts-45.1.3279.tar.gz (13.6 kB view hashes)

Uploaded Source

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page