For Enterprise Security, Threat Intelligence Management - What is the correct content of a STIX file?

[beano501]

We are trying to ingest a STIX file into the Threat Intelligence Management, the STIX parses, but does not find anything of interest in the file.

the _internal index has the message 'status="No observables or indicators found in file"'

The STIX file has the format below (which from what I can tell is a valid format, containing indicators

{
	"more": false,
	"objects": [
		{
			"confidence": "70",
			"created": "2023-09-08T00:02:39.000Z",
			"description": "xxxxxxxxx",
			"id": "xxxxxxx",
			"modified": "2023-09-08T00:02:39.000Z",
			"name": "xxxxxxx",
			"pattern": "[ipv4-addr:value = '101.38.159.17']",
			"spec_version": "2.1",
			"type": "indicator",
			"valid_from": "2023-09-08T00:02:39.000Z",
			"valid_until": "2025-11-07T00:02:39.000Z"
		},

                ......

Has anyone had any success with STIX files and be able to share the basic format of what worked for them?  Or anyone have anything other to suggest?

Many thanks

Simon

Splunk Enterprise Security  

[tscroggins]

Hi @beano501,

From the ES documentation at https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Uploadthreatfile:

Parsing STIX documents of version 2.0 and version 2.1 parses STIX observable objects such as type: "observed-data" from the threat intelligence document as outlined in the collections.conf configuration file. The STIX pattern syntax used in STIX "indicator" objects and elsewhere is not currently supported.

It's implied the parser expects observed-data objects and then reads observable-container objects from the child objects property. It's explicitly stated that pattern syntax is not supported.

This is confirmed in $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/bin/parsers/stix2_parser.py (not shown), where we can see the parser expects the deprecated objects property inside an observed-data object in both STIX 2.0 and STIX 2.1 documents.

We probably want something like this:

{
  "type": "bundle",
  "id": "bundle--50ea61e5-7cce-4a72-a876-bfe45793d235",
  "spec_version": "2.0",
  "objects": [
    {
      "type": "threat-actor",
      "id": "threat-actor--840bb5cd-af46-4c45-9489-43f7bfe612b8",
      "created": "2023-09-08T00:02:39.000Z",
      "modified": "2023-09-08T00:02:39.000Z",
      "name": "Bad Guys",
      "description": "No, really. They are bad guys.",
      "labels": [
        "uncategorized"
      ]
    },
    {
      "type": "observed-data",
      "id": "observed-data--110847c9-a492-4491-883f-0cea407bb6b1",
      "created": "2023-09-08T00:02:39.000Z",
      "modified": "2023-09-08T00:02:39.000Z",
      "first_observed": "2023-09-08T00:02:39.000Z",
      "last_observed": "2023-09-08T00:02:39.000Z",
      "number_observed": 1,
      "objects": {
        "0": {
          "type": "ipv4-addr",
          "value": "101.38.159.17"
        }
      }
    }
  ]
}

For more information about which properties are mapped from the nested object to the ip_intel collection, see the cited collections.conf file at $SPLUNK_HOME/etc/apps/DA-ESS-ThreatIntelligence/default/collections.conf:

# STIX2 Mappings to ip_intel
#    * <collection_field>    : <observable-type>.<observable-object-field>    - <observable-reference-type>.<reference-object-field>
#
#    * ip                    : ipv4-addr.value
#    *                       : ipv6-addr.value
#    * domain                : domain-name.value
#    * address               : None
#    * city                  : None
#    * country               : None
#    * postal_code           : None
#    * state_prov            : None
#    * oranization_name      : None
#    * organization_id       : None
#    * registration_time     : None
#    * description           : None
#    * threat_key            : <id of root element>|<simple filename>
#    * time                  : source_processed_time from threat_group_intel
#    * weight                : Parsed from the stanza if downloaded, or required input from user when uploaded
#    * updated               : None
#    * disabled              : false

The full list of supported STIX 2.x observed-data objects is:

• email-message => email_intel
• ipv4-addr => ip_intel
• ipv6-addr => ip_intel
• domain-name => ip_intel
• file => file_intel
• network-traffic (with http-request-ext extension) => http_intel
• process => process_intel
• process (with windows-service-ext extension) => service_intel
• windows-registry-key => registry_intel
• user-account => user_intel
• x509-certificate => certificate_intel