threatbus-vast 2020.9.30

A plugin to enable threatbus communication with VAST.

Threat Bus VAST Plugin

A Threat Bus plugin that enables communication with VAST.

Installation

pip install threatbus-vast

Configuration

The plugin uses ZeroMQ to communicate with the VAST bridge. The plugin serves as a ZeroMQ endpoint for the bridge to connect with. It uses three endpoints. One for managing subscriptions (and thus snapshot requests). The other two endpoints are for plain pub-sub operations.

...
plugins:
  vast:
    host: "127.0.0.1"
        manage: 13370
        pub: 13371
        sub: 13372
...

Initially, the bridge only needs to know the manage endpoint. The plugin and the vast-bridge negotiate all other internals for pub-sub message exchange at runtime.

License

Threat Bus comes with a 3-clause BSD license.