Anomali STAXX

Integration version: 3.0

Use cases

Ingest Anomali STAXX indicators and use them to create Google Security Operations SOAR alerts. Furthermore, alerts can be used to perform orchestrations with playbooks or manual analysis in Google Security Operations SOAR.

Configure Anomali STAXX integration in Google Security Operations SOAR

For detailed instructions about how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter name Type Default value Is mandatory Description
Instance Name String N/A No Name of the Instance you intend to configure integration for.
Description String N/A No Description of the Instance.
Server Address String https://<ip>:<port> Yes Server address of the Anomali STAXX instance.
Username String N/A Yes Username of the Anomali STAXX account.
Password Password N/A Yes Password of the Anomali STAXX account.
Verify SSL Checkbox Unchecked No If enabled, verifies that the SSL certificate for the connection to the Anomali STAXX server is valid.
Run Remotely Checkbox Checked No Check the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).

Actions

Ping

Description

Test connectivity to Anomali STAXX with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run on

This action doesn't run on entities, nor has mandatory input parameters.

Action results

Script result
Script result name Value options Example
is_success True or False is_success:False
Case wall
Result type Description Type
Output message*

The action should not fail nor stop a playbook execution:

if successful: "Successfully connected to the Anomali STAXX server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the Anomali STAXX server! Error is {0}".format(exception.stacktrace)

 General

Connectors

Anomali STAXX - Indicators Connector

Description

Pull indicators from Anomali STAXX.

Configure Anomali STAXX - Indicators Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter name Type Default value Is mandatory Description
Product Field Name String Product Name Yes Enter the source field name in order to retrieve the Product Field name.
Event Field Name String itype Yes Enter the source field name in order to retrieve the Event Field name.
Environment Field Name String "" No

Describes the name of the field where the environment name is stored.

If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern String .* No

A regex pattern to run on the value found in the "Environment Field Name" field.

Default is .* to catch all and return the value unchanged.

Used to allow the user to manipulate the environment field via regex logic.

If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds) Int 180 Yes Timeout limit for the python process running the current script.
Server Address String https://<ip>:<port> Yes Server address of the Anomali STAXX instance.
Username String N/A Yes Username of the Anomali STAXX account.
Password Password N/A Yes Password of the Anomali STAXX account.
Server Timezone String N/A No Specify which timezone is set on the Anomali STAXX server in regards to UTC. For example, +1, -1, etc. If nothing is specified, the connector will use UTC as a default timezone.
Lowest Severity To Fetch String Medium Yes

Lowest severity that will be used to fetch Indicators.

Possible values:

  • Low
  • Medium
  • High
  • Critical
Lowest Confidence To Fetch Integer 0 No Lowest confidence that will be used to fetch indicators.
Fetch Max Hours Backwards Integer 1 No Amount of hours from where to fetch indicators.
Max Indicators To Fetch Integer 50 No How many indicators to process per one connector iteration.
Use whitelist as a blacklist Checkbox Unchecked Yes If enabled, whitelist will be used as a blacklist.
Verify SSL Checkbox Unchecked Yes If enabled, verify the SSL certificate for the connection to the Anomali STAXX server is valid.
Proxy Server Address String N/A No The address of the proxy server to use.
Proxy Username String N/A No The proxy username to authenticate with.
Proxy Password Password N/A No The proxy password to authenticate with.

Connector Rules

Proxy Support

The connector supports Proxy.