-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[new module] Add ti_threatconnect (#45)
Add a terraform module for managing the TI ThreatConnect Fleet integration.
- Loading branch information
1 parent
274d916
commit 66cc096
Showing
4 changed files
with
197 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| ```release-note:enhancement | ||
| Generate Terraform modules for the ti_threatconnect Fleet integration. | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
fleet_integration/ti_threatconnect.threatconnect.indicator.cel/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| <!-- BEGIN_TF_DOCS --> | ||
| ## Requirements | ||
|
|
||
| No requirements. | ||
|
|
||
| ## Providers | ||
|
|
||
| No providers. | ||
|
|
||
| ## Modules | ||
|
|
||
| | Name | Source | Version | | ||
| |------|--------|---------| | ||
| | <a name="module_fleet_package_policy"></a> [fleet\_package\_policy](#module\_fleet\_package\_policy) | ../../fleet_package_policy | n/a | | ||
|
|
||
| ## Resources | ||
|
|
||
| No resources. | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_access_id"></a> [access\_id](#input\_access\_id) | Access ID of a ThreatConnect API User. | `string` | n/a | yes | | ||
| | <a name="input_batch_size"></a> [batch\_size](#input\_batch\_size) | Batch size for the response of the ThreatConnect API. The maximum supported batch size value is 10000. | `number` | `5000` | no | | ||
| | <a name="input_enable_request_tracer"></a> [enable\_request\_tracer](#input\_enable\_request\_tracer) | The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. | `bool` | `null` | no | | ||
| | <a name="input_fleet_agent_policy_id"></a> [fleet\_agent\_policy\_id](#input\_fleet\_agent\_policy\_id) | Agent policy ID to add the package policy to. | `string` | n/a | yes | | ||
| | <a name="input_fleet_data_stream_namespace"></a> [fleet\_data\_stream\_namespace](#input\_fleet\_data\_stream\_namespace) | Namespace to use for the data stream. | `string` | `"default"` | no | | ||
| | <a name="input_fleet_package_policy_description"></a> [fleet\_package\_policy\_description](#input\_fleet\_package\_policy\_description) | Description to use for the package policy. | `string` | `""` | no | | ||
| | <a name="input_fleet_package_policy_name_suffix"></a> [fleet\_package\_policy\_name\_suffix](#input\_fleet\_package\_policy\_name\_suffix) | Suffix to append to the end of the package policy name. | `string` | `""` | no | | ||
| | <a name="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version) | Version of the ti\_threatconnect package to use. | `string` | `"0.4.0"` | no | | ||
| | <a name="input_http_client_timeout"></a> [http\_client\_timeout](#input\_http\_client\_timeout) | Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. | `string` | `"2m"` | no | | ||
| | <a name="input_initial_interval"></a> [initial\_interval](#input\_initial\_interval) | How far back to pull Indicators and the groups associated with those indicators from ThreatConnect. Supported units for this parameter are h/m/s. | `string` | `"168h"` | no | | ||
| | <a name="input_interval"></a> [interval](#input\_interval) | Duration between requests to the ThreatConnect API. Supported units for this parameter are h/m/s. | `string` | `"24h"` | no | | ||
| | <a name="input_ioc_expiration_duration"></a> [ioc\_expiration\_duration](#input\_ioc\_expiration\_duration) | Enforces all IOCs to expire after this duration. This setting is required to avoid "orphaned" IOCs that never expire. Specify [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) using only days, hours, or minutes (e.g., 10d), avoiding mixed time units. | `string` | `"90d"` | no | | ||
| | <a name="input_preserve_original_event"></a> [preserve\_original\_event](#input\_preserve\_original\_event) | Preserves a raw copy of the original event, added to the field `event.original`. | `bool` | `false` | no | | ||
| | <a name="input_processors_yaml"></a> [processors\_yaml](#input\_processors\_yaml) | Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. | `string` | `null` | no | | ||
| | <a name="input_proxy_url"></a> [proxy\_url](#input\_proxy\_url) | URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format. | `string` | `null` | no | | ||
| | <a name="input_secret_key"></a> [secret\_key](#input\_secret\_key) | Secret Key of a ThreatConnect API User. | `string` | n/a | yes | | ||
| | <a name="input_ssl_yaml"></a> [ssl\_yaml](#input\_ssl\_yaml) | i.e. certificate\_authorities, supported\_protocols, verification\_mode etc. | `string` | `"#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n"` | no | | ||
| | <a name="input_tags"></a> [tags](#input\_tags) | n/a | `list(string)` | <pre>[<br> "forwarded",<br> "threatconnect-indicator"<br>]</pre> | no | | ||
| | <a name="input_tql"></a> [tql](#input\_tql) | Filter results based on query written in [TQL](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql). | `string` | `null` | no | | ||
| | <a name="input_url"></a> [url](#input\_url) | Base URL of the ThreatConnect API. Default URL given is for the ThreatConnect's Public Cloud instance. Note: Do not include trailing slash “/” character. | `string` | `"https://app.threatconnect.com"` | no | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | <a name="output_id"></a> [id](#output\_id) | Package policy ID | | ||
| <!-- END_TF_DOCS --> |
143 changes: 143 additions & 0 deletions
143
fleet_integration/ti_threatconnect.threatconnect.indicator.cel/module.tf.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,143 @@ | ||
| { | ||
| "//": "Generated by fleet-terraform-generator - DO NOT EDIT", | ||
| "variable": { | ||
| "access_id": { | ||
| "type": "string", | ||
| "description": "Access ID of a ThreatConnect API User.", | ||
| "nullable": false | ||
| }, | ||
| "batch_size": { | ||
| "type": "number", | ||
| "description": "Batch size for the response of the ThreatConnect API. The maximum supported batch size value is 10000.", | ||
| "default": 5000, | ||
| "nullable": false | ||
| }, | ||
| "enable_request_tracer": { | ||
| "type": "bool", | ||
| "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", | ||
| "default": null | ||
| }, | ||
| "fleet_agent_policy_id": { | ||
| "type": "string", | ||
| "description": "Agent policy ID to add the package policy to." | ||
| }, | ||
| "fleet_data_stream_namespace": { | ||
| "type": "string", | ||
| "description": "Namespace to use for the data stream.", | ||
| "default": "default" | ||
| }, | ||
| "fleet_package_policy_description": { | ||
| "type": "string", | ||
| "description": "Description to use for the package policy.", | ||
| "default": "" | ||
| }, | ||
| "fleet_package_policy_name_suffix": { | ||
| "type": "string", | ||
| "description": "Suffix to append to the end of the package policy name.", | ||
| "default": "" | ||
| }, | ||
| "fleet_package_version": { | ||
| "type": "string", | ||
| "description": "Version of the ti_threatconnect package to use.", | ||
| "default": "0.4.0" | ||
| }, | ||
| "http_client_timeout": { | ||
| "type": "string", | ||
| "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", | ||
| "default": "2m", | ||
| "nullable": false | ||
| }, | ||
| "initial_interval": { | ||
| "type": "string", | ||
| "description": "How far back to pull Indicators and the groups associated with those indicators from ThreatConnect. Supported units for this parameter are h/m/s.", | ||
| "default": "168h", | ||
| "nullable": false | ||
| }, | ||
| "interval": { | ||
| "type": "string", | ||
| "description": "Duration between requests to the ThreatConnect API. Supported units for this parameter are h/m/s.", | ||
| "default": "24h", | ||
| "nullable": false | ||
| }, | ||
| "ioc_expiration_duration": { | ||
| "type": "string", | ||
| "description": "Enforces all IOCs to expire after this duration. This setting is required to avoid \"orphaned\" IOCs that never expire. Specify [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) using only days, hours, or minutes (e.g., 10d), avoiding mixed time units.", | ||
| "default": "90d", | ||
| "nullable": false | ||
| }, | ||
| "preserve_original_event": { | ||
| "type": "bool", | ||
| "description": "Preserves a raw copy of the original event, added to the field `event.original`.", | ||
| "default": false, | ||
| "nullable": false | ||
| }, | ||
| "processors_yaml": { | ||
| "type": "string", | ||
| "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", | ||
| "default": null | ||
| }, | ||
| "proxy_url": { | ||
| "type": "string", | ||
| "description": "URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.", | ||
| "default": null | ||
| }, | ||
| "secret_key": { | ||
| "type": "string", | ||
| "description": "Secret Key of a ThreatConnect API User.", | ||
| "sensitive": true, | ||
| "nullable": false | ||
| }, | ||
| "ssl_yaml": { | ||
| "type": "string", | ||
| "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.", | ||
| "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" | ||
| }, | ||
| "tags": { | ||
| "type": "list(string)", | ||
| "default": [ | ||
| "forwarded", | ||
| "threatconnect-indicator" | ||
| ], | ||
| "nullable": false | ||
| }, | ||
| "tql": { | ||
| "type": "string", | ||
| "description": "Filter results based on query written in [TQL](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql).", | ||
| "default": null | ||
| }, | ||
| "url": { | ||
| "type": "string", | ||
| "description": "Base URL of the ThreatConnect API. Default URL given is for the ThreatConnect's Public Cloud instance. Note: Do not include trailing slash “/” character.", | ||
| "default": "https://app.threatconnect.com", | ||
| "nullable": false | ||
| } | ||
| }, | ||
| "output": { | ||
| "id": { | ||
| "description": "Package policy ID", | ||
| "value": "${module.fleet_package_policy.id}" | ||
| } | ||
| }, | ||
| "module": { | ||
| "fleet_package_policy": { | ||
| "agent_policy_id": "${var.fleet_agent_policy_id}", | ||
| "all_data_streams": [ | ||
| "indicator" | ||
| ], | ||
| "all_policy_template_inputs": [ | ||
| "threatconnect-cel" | ||
| ], | ||
| "data_stream": "indicator", | ||
| "data_stream_variables_json": "${jsonencode({\n batch_size = var.batch_size\n enable_request_tracer = var.enable_request_tracer\n http_client_timeout = var.http_client_timeout\n initial_interval = var.initial_interval\n interval = var.interval\n ioc_expiration_duration = var.ioc_expiration_duration\n preserve_original_event = var.preserve_original_event\n processors = var.processors_yaml\n tags = var.tags\n tql = var.tql\n})}", | ||
| "description": "${var.fleet_package_policy_description}", | ||
| "input_type": "cel", | ||
| "input_variables_json": "${jsonencode({\n access_id = var.access_id\n proxy_url = var.proxy_url\n secret_key = var.secret_key\n ssl = var.ssl_yaml\n url = var.url\n})}", | ||
| "namespace": "${var.fleet_data_stream_namespace}", | ||
| "package_name": "ti_threatconnect", | ||
| "package_policy_name": "ti_threatconnect-indicator-${var.fleet_data_stream_namespace}${var.fleet_package_policy_name_suffix}", | ||
| "package_version": "${var.fleet_package_version}", | ||
| "policy_template": "threatconnect", | ||
| "source": "../../fleet_package_policy" | ||
| } | ||
| } | ||
| } |