Resilient Lightweight Custom Threat Service
This package implements the Custom Threat Service API, providing a simple framework to develop threat source lookups in Python using the Resilient Circuits integration framework.
It's suitable for simple "lightweight" threat source lookups.
- All lookups are asynchronous.
- There is currently no support for file-attachment handling.
- Queries are not stored persistently, so if you need to track external resources (for example, if your threat service starts a long-running task such as sandbox processing) those will not be tracked across restarts.
For more robust and advanced features, you should consider deploying a standalone threat service, for example based on the Django example (https://github.com/ibmresilient/resilient-python-examples/tree/master/django-custom-threat-service).
What's new
v42 supports resutil threatserviceedit -user and -password authentication
Environment
This package requires that it is installed on a RHEL platform and that the resilient-circuits application is running.
Install this package with 'pip', or python setup.py install.
To set the config values in the app.config file run resilient-circuits config -u.
Config values example:
[custom_threat_service]
# Base URL for threat services API
urlbase=/cts
# Whether we support file upload (for "file"-type artifacts)
# upload_file=False
# Retry time indicators
#first_retry_secs=5
#later_retry_secs=60
#max_retries=60
# Cache management
#cache_size=10000
#cache_ttl=600000
# use auth_user and auth_password when specifying the -user and -password parameters on
# resutil threatserviceedit to ensure basic authentication
#auth_user=
#auth_password=
Run with: resilient-circuits run.
Custom Threat Service Example
This package includes an example threat service that responds to 'URL' artifacts with
static data. To register the example onto your Resilient server (assuming that the
resilient-circuits application is running on the same server):
sudo resutil threatserviceedit -name example -resturl http://127.0.0.1:9000/cts/example
sudo resutil threatservicetest -name example
To delete,
sudo resutil threatservicedel -name example
1 maintainer
Metadata
1 maintainer
Release files for rc-cts 45.1.3279
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| rc-cts-45.1.3279.tar.gz | 13.6 kB | Details |
Release files / rc-cts-45.1.3279.tar.gz
| Download URL | rc-cts-45.1.3279.tar.gz |
|---|---|
| Size | 13.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e0a69dc70aff20e20afe1c51fb4137096c8302a71dfa411bca91f3e186fc70dd
|
|
BLAKE2b-256 checksum How to use checksums |
3bcc46c7005a83f70b455e7c69b4c75dc6b1b11b9c9494061c26e3ad00d0a4ef
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.1 CPython/3.9.13
|
