IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  rc_cts package (development)

    Posted 10/07/19 08:48 AM

    Hi All, 

    I wanted to develop rc_cts (custom threat service) package for one of our custom API integration. Is there any way to generate *codegen* like command available to generate package structure (or) Do we need to take sample (misp/haveibeenpwned) rc_cts package structure and modify accordingly ? 

    Regards, 

    Santhosh Baswa



    ------------------------------
    SANTHOSH BASWA
    ------------------------------


  • 2.  RE: rc_cts package (development)

    Posted 10/07/19 10:31 AM
    Santhosh,

    I'm about to attempt to create my own CTS and I have the same question. 

    I've found documentation that states that the rc_cts package isn't the most robust way to create CTSes here.

    I was considering looking into creating the CTS with Django, but if rc_cts makes it easier I would probably just roll with that.

    ------------------------------
    Liam Mahoney
    ------------------------------



  • 3.  RE: rc_cts package (development)

    Posted 10/07/19 10:57 PM
    Hi Liam, 

    Yesterday, I successfully developed own custom rc_cts package by using  existing/developed (rc_cts_abuseipdb) cts packages.  

    Here is my learnings: 
    -  Created an rc_cts package strcture properly like below.  
    - .\rc-cts-xxxxxx
          - \.rc_cts_xxxxxx
               - \.components
                    - __init__.py
                    - xxxxxx_threat_searcher.py
                 - __init__.py
           - setup.py
           - tox.ini
    - Change the setup.py configuration. (entry_points) #threat service & component names #gen_config
    -  xxxxx_threat_searcher.py 
    • def config_section_data() : This config data automatically update in app.config 
    • Create *class rc_cts_searcher* class. 
    • channel = searcher_channel("xxxxx_customthreatservicename") #sudo resutil threatserviceedit -name "xxxxx_customthreatservicename"
    • @handler("Input Artifact type Ex: net.ip etc")
    • Define lookup/query/result functions according your requirement. 
    • xxxx.append(xxxx.append( Hit( Outputdata ))) & return the (xxxx). (xxxx = values)

           ​
    Thanks, 

    Santhosh Baswa



    ------------------------------
    SANTHOSH BASWA
    ------------------------------

    Original Message


  • 4.  RE: rc_cts package (development)

    Posted 10/08/19 11:51 AM
    Santhosh,

    Thank you for that, I'll definitely have to check it out!

    ------------------------------
    Liam Mahoney
    ------------------------------

    Original Message


Related Content