[TI MISP] Add datastream for Attributes API endpoint (#4136)

* [TI MISP] Add datastream for Attributes API endpoint --------- Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> Co-authored-by: kcreddy <krish.reddy91@gmail.com>

Author: 3 people

packages/ti_misp/_dev/build/docs/README.md

@@ -13,4 +13,12 @@ The filters themselves are based on the [MISP API documentation](https://www.cir
 
 {{fields "threat"}}
 
-{{event "threat"}}
+{{event "threat"}}
+
+### Threat Attributes
+
+The MISP integration configuration allows to set the polling interval, how far back it should look initially, and optionally any filters used to filter the results.
+This data stream uses the `/attributes/restSearch` API endpoint which returns more granular information regarding MISP attributes and additional information.
+
+{{fields "threat_attributes"}}
+

packages/ti_misp/_dev/deploy/docker/files/config.yml

@@ -314,3 +314,165 @@ rules:
  {
  "response": []
  }
+ - path: /attributes/restSearch
+ methods: ["POST"]
+ request_headers:
+ Authorization: "test"
+ Content-Type: application/json
+ request_body: /^{"limit":"10","page":"1","returnFormat":"json","timestamp":/
+ responses:
+ - status_code: 200
+ body: |-
+ {
+ "response": {
+ "Attribute": [
+ {
+ "id": "1",
+ "event_id": "1",
+ "object_id": "0",
+ "object_relation": null,
+ "category": "External analysis",
+ "type": "link",
+ "to_ids": false,
+ "uuid": "542e4cbd-ee78-4a57-bfb8-1fda950d210b",
+ "timestamp": "1412320445",
+ "distribution": "5",
+ "sharing_group_id": "0",
+ "comment": "",
+ "deleted": false,
+ "disable_correlation": false,
+ "first_seen": null,
+ "last_seen": null,
+ "value": "http://labs.opendns.com/2014/10/02/opendns-and-bash/",
+ "Event": {
+ "org_id": "1",
+ "distribution": "3",
+ "id": "1",
+ "info": "OSINT ShellShock scanning IPs from OpenDNS",
+ "orgc_id": "2",
+ "uuid": "542e4c9c-cadc-4f8f-bb11-6d13950d210b"
+ }
+ },
+ {
+ "id": "2",
+ "event_id": "1",
+ "object_id": "0",
+ "object_relation": null,
+ "category": "External analysis",
+ "type": "link",
+ "to_ids": false,
+ "uuid": "542e4cbe-d560-4e14-9157-1fda950d210b",
+ "timestamp": "1412320446",
+ "distribution": "5",
+ "sharing_group_id": "0",
+ "comment": "",
+ "deleted": false,
+ "disable_correlation": false,
+ "first_seen": null,
+ "last_seen": null,
+ "value": "https://gist.github.com/andrewsmhay/de1cdc63d04c2bbf8c12",
+ "Event": {
+ "org_id": "1",
+ "distribution": "3",
+ "id": "1",
+ "info": "OSINT ShellShock scanning IPs from OpenDNS",
+ "orgc_id": "2",
+ "uuid": "542e4c9c-cadc-4f8f-bb11-6d13950d210b"
+ }
+ },
+ {
+ "id": "3",
+ "event_id": "1",
+ "object_id": "0",
+ "object_relation": null,
+ "category": "External analysis",
+ "type": "link",
+ "to_ids": false,
+ "uuid": "542e4cbe-12a4-4345-b0a4-1fda950d210b",
+ "timestamp": "1412320446",
+ "distribution": "5",
+ "sharing_group_id": "0",
+ "comment": "",
+ "deleted": false,
+ "disable_correlation": false,
+ "first_seen": null,
+ "last_seen": null,
+ "value": "https://gist.githubusercontent.com/andrewsmhay/de1cdc63d04c2bbf8c12/raw/f20402cf5a0c646c63c4521f60587703fe654443/iplist",
+ "Event": {
+ "org_id": "1",
+ "distribution": "3",
+ "id": "1",
+ "info": "OSINT ShellShock scanning IPs from OpenDNS",
+ "orgc_id": "2",
+ "uuid": "542e4c9c-cadc-4f8f-bb11-6d13950d210b"
+ }
+ },
+ {
+ "id": "4",
+ "event_id": "1",
+ "object_id": "0",
+ "object_relation": null,
+ "category": "External analysis",
+ "type": "text",
+ "to_ids": false,
+ "uuid": "542e4ccc-b8fc-44af-959d-6ead950d210b",
+ "timestamp": "1412320460",
+ "distribution": "5",
+ "sharing_group_id": "0",
+ "comment": "",
+ "deleted": false,
+ "disable_correlation": false,
+ "first_seen": null,
+ "last_seen": null,
+ "value": "Shellshock",
+ "Event": {
+ "org_id": "1",
+ "distribution": "3",
+ "id": "1",
+ "info": "OSINT ShellShock scanning IPs from OpenDNS",
+ "orgc_id": "2",
+ "uuid": "542e4c9c-cadc-4f8f-bb11-6d13950d210b"
+ }
+ },
+ {
+ "id": "5",
+ "event_id": "1",
+ "object_id": "0",
+ "object_relation": null,
+ "category": "External analysis",
+ "type": "comment",
+ "to_ids": false,
+ "uuid": "542e4ce7-6120-41c0-8793-e90e950d210b",
+ "timestamp": "1412320487",
+ "distribution": "5",
+ "sharing_group_id": "0",
+ "comment": "",
+ "deleted": false,
+ "disable_correlation": false,
+ "first_seen": null,
+ "last_seen": null,
+ "value": "Data encoded by David André",
+ "Event": {
+ "org_id": "1",
+ "distribution": "3",
+ "id": "1",
+ "info": "OSINT ShellShock scanning IPs from OpenDNS",
+ "orgc_id": "2",
+ "uuid": "542e4c9c-cadc-4f8f-bb11-6d13950d210b"
+ }
+ }
+ ]
+ }
+ }
+ - path: /attributes/restSearch
+ methods: ["POST"]
+ request_headers:
+ Authorization: "test"
+ Content-Type: application/json
+ request_body: /^{"limit":"10","page":"2","returnFormat":"json","timestamp":/
+ responses:
+ - status_code: 200
+ body: |-
+ {
+ "response": []
+ }

packages/ti_misp/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.11.0"
+ changes:
+ - description: Add Attributes datastream
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/4136
 - version: "1.10.1"
  changes:
  - description: Drop empty event sets.