• All Files

Home

Updating Anonymity Networks

This section describes how to update Anonymity Networks information into FortiSIEM from external threat feed websites.

You can update the Anonymity Network using the following options:

• Import from a CSV file
• Update via API

Prerequisites:

Before proceeding, gather the following information about a threat feed web site.

• Website URL
• Credentials required to access the website (optional)
• If the website is not supported by FortiSIEM, you need to understand the format of the data returned by the URL.
  • If the data is in the comma separated value format (the separator need not be a comma but could be any separator, then a simple integration is possible.)
  • If the data is any other format, for example, XML, then some code needs to be written for integration using the FortiSIEM provided framework.

Import from a CSV file

Custom websites - CSV data - one-time manual import

Instead of manually adding anonymity networks to a group individually, you can upload a CSV file with multiple entries. This requires that the data to be imported is already in a file in comma separated value format.

IP, Port, Malware Type, Confidence, Severity, Asn, Org, Country, Description, Data Found(MM/DD/YYYY), Last Seen(MM/DD/YYYY)

Note: Although many fields are possible, only the IP is required.

1. Go to RESOURCES > Anonymity Network.
2. Select the group from the left panel or create a new group by clicking the + icon above the list of RESOURCES groups.
3. Select More > Update.
4. Select Import from a CSV file and choose the file to import.
5. Click Import.

Update via API

This section describes how to import anonymity networks information into FortiSIEM from external threat feed websites. Anonymity networks are used by malware to hide their own identity.

Websites with built in support

The following websites are supported:

• Threat Stream Open Proxy  (https://api.threatstream.com)
• Threat Stream TOR Node  (https://api.threatstream.com)

Follow the procedure below to import data from these websites:

1. Go to Resources > Anonymity Network.
2. Select the folder and find the website you need to import data from.  
3. Click More > Update.
4. Select Update via API. The link will be displayed in the URL field or else manually enter the URL and details.
5. Enter a Schedule by clicking the + icon.
6. Enter the schedule parameters - Start Time and Recurrence Pattern. FortiSIEM recommends no more frequent than hourly.
7. Click Save.
   You can use the edit icon to modify or delete icon to remove a Schedule.

Custom websites - CSV data - programmatic import

This requires that the web site data is:

• a file in comma separated value format (separator can be any special character such as space, tab, hash, dollar etc.)
• one entry is in a single line.
  

Note: Although many fields are possible, only the IP is required.

1. Go to RESOURCES> Anonymity Network.
2. Select the folder or click + to add a new group under Anonymity Network folder.
3. Click More > Update.
4. Select Update via API. The link will be displayed in the URL field or else manually enter the URL and details.
5. Click the edit icon near URL.
6. Enter the following information:
   1. Enter the URL of the website.
   2. Enter User Name and Password (optional)
   3. For Plugin Class, the default class 'com.accelops.service.threatfeed.impl.ThreatFeedWithMappingPolicyService' is shown. Do not modify this in this case.
   4. Enter the correct Field Separator (by default it is a comma).
   5. Select CSV as the Data Format.
   6. Select Data Update as Full or Incremental.
   7. Enter the Data Mapping by choosing the mapped field and the corresponding position in the website data. For example, if the IP is in third position, choose 3 in the Position column. Click + if you need to add more rows.
   8. Click Save
7. Select an import schedule by clicking + on the Schedule Summary. Select when to start the import and how often to import to get new data from the website.
   The imported data will show on the right pane after some time.

New Websites - non-CSV data - programmatic import

This is the most general case where the website data format does not satisfy the previous conditions. In this case, you have to write a Java plug-in class by modifying the default system provided one. After the class has been written and fully tested for correctness, follow these steps.

1. Go to RESOURCES> Anonymity Network.
2. Select the folder or click + to add a new group under Anonymity Network folder.
3. Click More > Update.
4. Select Update via API.
5. Click the edit icon near URL.
6. Enter the following information:
   1. Enter the URL of the website.
   2. Enter User Name and Password (optional)
   3. For Plugin Class, the custom Java class in this case.
   4. Enter the correct Field Separator (by default it is a comma).
   5. Select Custom or STIX-TAXII as the Data Format.
   6. Select Data Update as Full or Incremental.
   7. Click Save.
7. Select an import schedule by clicking + on the Schedule Summary. Select when to start the import and how often to import to get new data from the website.
   The imported data will show on the table after some time.