ESS 1.1.2 lookups

[rroberts]

What lookups do external calls in the ESS 1.1.2 app?

[rroberts · Accepted solution]

SANS block list

[sans_blocklist_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=sans_blocklist.csv
external_type = python
fields_list = src,src_ip,src_is_sans,src_country,dest,dest_ip,dest_is_sans,dest_country

bogon list

[bogonlist_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=bogonlist.csv
external_type = python
fields_list = src,src_ip,src_is_bogon,src_is_internal,dest,dest_ip,dest_is_bogon,dest_is_internal

spyware associated IP address list

[ip_spyware_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_spywarelist.csv
external_type = python
fields_list = src,src_ip,src_description,src_is_spyware,dest,dest_ip,dest_description,dest_is_spyware

proxy associated IP address list

[ip_proxy_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_proxylist.csv
external_type = python
fields_list = src,src_ip,src_is_proxy,dest,dest_ip,dest_is_proxy

web-attacker associated IP address list

[ip_webattacker_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_webattackerlist.csv
external_type = python
fields_list = src,src_ip,src_description,src_is_web_attacker,dest,dest_ip,dest_description,dest_is_web_attacker

RapidShare associated IP address list

[ip_rapidshare_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_rapidsharelist.csv
external_type = python
fields_list = src,src_ip,src_is_rapidshare,dest,dest_ip,dest_is_rapidshare

LogMeIn associated IP address list

[ip_logmein_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_logmeinlist.csv
external_type = python
fields_list = src,src_ip,src_is_logmein,dest,dest_ip,dest_is_logmein

PirateBay associated IP address list

[ip_piratebay_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_piratebaylist.csv
external_type = python
fields_list = src,src_ip,src_is_piratebay,dest,dest_ip,dest_is_piratebay

Tor associated IP address list

[ip_tor_lookup]

external_cmd = assetLookup.py assetFields=src,dest debug=False app=SA-ThreatIntelligence file=ip_torlist.csv
external_type = python
fields_list = src,src_ip,src_is_tor,dest,dest_ip,dest_is_tor

Prohibited services

[prohibited_services_lookup]

filename = prohibited_services.csv

Prohibited processes

[prohibited_processes_lookup]

filename = prohibited_processes.csv