布谷鸟

集成版本：10.0

在 Google Security Operations 中配置 Cuckoo 集成

配置 Cuckoo 与 CA 证书的集成

您可以根据需要使用 CA 证书文件验证连接。

在开始之前，请确保您满足以下条件：

  • CA 证书文件
  • 最新的 Cuckoo 集成版本

如需配置与 CA 证书的集成，请完成以下步骤：

  1. 将您的 CA 证书文件解析为 Base64 字符串。
  2. 打开集成配置参数页面。
  3. 将该字符串插入到 CA 证书文件字段中。
  4. 如需测试集成是否已成功配置，请选中验证 SSL 复选框，然后点击测试。

在 Google SecOps 中配置 Cuckoo 集成

有关如何在 Google SecOps 中配置集成的详细说明，请参阅配置集成。

集成参数

使用以下参数配置集成：

参数显示名称 类型 默认值 是否为必需属性 说明
实例名称 字符串 不适用 否 您打算为其配置集成的实例的名称。
说明 字符串 不适用 否 实例的说明。
API 根 字符串 http://x.x.x.x:8090 是 Cuckoo 实例的地址。
Web 界面地址 字符串 http://x.x.x.x:8000 是 Cuckoo Web 界面实例的地址。
警告阈值 整数 5.0 是 不适用
CA 证书文件 字符串 不适用 否 不适用
验证 SSL 复选框 尚未核查 否 如果您的 Cuckoo 连接需要 SSL 验证，请选中此复选框。
远程运行 复选框 尚未核查 否

选中相应字段，以便远程运行配置的集成。

选中后，系统会显示用于选择远程用户（客服人员）的选项。
API 令牌 密码 不适用 否 集成项目的 API 令牌。

操作

引爆文件

说明

提交文件以进行分析并获取报告，也称为异步。

参数

参数显示名称 类型 默认值 是否为必需属性 说明
文件路径 字符串 不适用 是 要提交的文件的路径。

运行于

此操作会在所有实体上运行。

操作执行结果

脚本结果
脚本结果名称 值选项 示例
max_score 不适用 不适用
JSON 结果
{
    "powershell8693919272434274241.ps1": {
        "info": {
            "category": "file",
            "added": 1547640117.991152,
            "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
            "package": "ps1",
            "started": 1547640190.471362,
            "route": "internet",
            "custom": null,
            "machine": {
                "status": "stopped",
                "shutdown_on": "2019-01-16 12:28:55",
                "started_on": "2019-01-16 12:03:16",
                "manager": "VirtualBox",
                "label": "win7x6427",
                "name": "win7x6427"
            },
            "ended": 1547641736.394026,
            "score": 6.6,
            "platform": "windows",
            "version": "2.0.6",
            "owner": null,
            "git": {
                "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
                "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
            },
            "options": "procmemdump=yes,route=internet",
            "id": 889621,
            "duration": 1545
        },
        "signatures":
        [{
            "families": [],
            "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
            "name": "network_cnc_http",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "suspicious_features": "Connection to IP address",
                "type": "generic",
                "suspicious_request": "GET http://1.1.1.1:8080/"
            }],
            "severity": 2
        }, {
            "families": [],
            "description": "Connects to smtp.live.com, possibly for spamming or data exfiltration",
            "name": "smtp_live",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "category": "domain",
                "type": "ioc",
                "ioc": "smtp.live.com",
                "description": null
            }],
            "severity": 2
        }, {
            "families": [],
            "description": "Connects to smtp.mail.yahoo.com, possibly for spamming or data exfiltration",
            "name": "smtp_yahoo",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "category": "domain",
                "type": "ioc",
                "ioc": "smtp.mail.yahoo.com",
                "description": null
            }],
            "severity": 2
        }]
    }
}

引爆网址

说明

发送网址以供分析并获取报告，也称为异步。

参数

不适用

运行于

此操作在网址实体上运行。

操作执行结果

脚本结果
脚本结果名称 值选项 示例
is_success True/False is_success:False
JSON 结果
[
    {
        "EntityResult": {
            "info": {
                "category": "url",
                "git": {
                    "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
                    "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
                },
                "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
                "package": "ie",
                "started": null,
                "route": "internet",
                "custom": null,
                "machine": {
                    "status": "stopped",
                    "shutdown_on": "2019-01-16 13:14:26",
                    "label": "win7x6412",
                    "manager": "VirtualBox",
                    "started_on": "2019-01-16 12:48:54",
                    "name": "win7x6412"
                },
                "ended": 1547644467.207864,
                "added": null,
                "id": 889669,
                "platform": null,
                "version": "2.0.6",
                "owner": null,
                "score": 4.4,
                "options": "procmemdump=yes,route=internet",
                "duration": null
            },
            "signatures": [{
                "families": [],
                "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
                "name": "network_cnc_http",
                "markcount": 1,
                "references": [],
                "marks": [{
                    "suspicious_features": "Connection to IP address",
                    "type": "generic",
                    "suspicious_request": "GET http://1.1.1.1:8080/"
                }],
                "severity": 2
            }, {
                "families": [],
                "description": "Performs some HTTP requests",
                "name": "network_http",
                "markcount": 9,
                "references": [],
                "marks": [{
                    "category": "request",
                    "ioc": "GET http://crl.microsoft.com/pki/crl/products/WinPCA.crl",
                    "type": "ioc",
                    "description": null
                }, {
                    "category": "request",
                    "ioc": "GET http://www.microsoft.com/pki/crl/products/WinPCA.crl",
                    "type": "ioc",
                    "description": null
                }, {
                    "category": "request",
                    "ioc": "GET http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
                    "type": "ioc",
                    "description": null
                }],
                "severity": 2
            }, {
                "families": [],
                "description": "Communicates with host for which no DNS query was performed",
                "name": "nolookup_communication",
                "markcount": 11,
                "references": [],
                "marks": [{
                    "host": "1.1.1.1",
                    "type": "generic"
                }, {
                    "host": "1.1.1.1",
                    "type": "generic"
                }, {
                    "host": "1.1.1.1",
                    "type": "generic"
                }],
                "severity": 3
            }]},
        "Entity": "http://digi.ba/eng/#pgc-56-0-0"
    }
]
实体扩充

如果得分超过阈值，则将实体标记为可疑 (True)。 否则：False。

扩充项字段名称 逻辑 - 适用情形
Cuckoo_Score 不适用
task_id 不适用

获取报告

说明

按 ID（也称为异步 ID）获取特定任务的报告。

参数

参数显示名称 类型 默认值 是否为必需属性 说明
任务 ID 字符串 不适用 是

任务的 ID。

示例：10

运行于

此操作会在所有实体上运行。

操作执行结果

脚本结果
脚本结果名称 值选项 示例
得分 不适用 不适用
JSON 结果
{
    "info": {
        "category": "file",
        "added": 1547640117.991152,
        "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
        "package": "ps1",
        "started": 1547640190.471362,
        "route": "internet",
        "custom": null,
        "machine": {
            "status": "stopped",
            "shutdown_on": "2019-01-16 12:28:55",
            "started_on": "2019-01-16 12:03:16",
            "manager": "VirtualBox",
            "label": "win7x6427",
            "name": "win7x6427"
        },
        "ended": 1547641736.394026,
        "score": 6.6,
        "platform": "windows",
        "version": "2.0.6",
        "owner": null,
        "git": {
            "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
            "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
        },
        "options": "procmemdump=yes,route=internet",
        "id": 889621,
        "duration": 1545
    },
    "signatures": [{
        "families": [],
        "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "name": "network_cnc_http",
        "markcount": 1,
        "references": [],
        "marks": [{
            "suspicious_features": "Connection to IP address",
            "type": "generic",
            "suspicious_request": "GET http://1.1.1.1:8080/"
        }],
        "severity": 2
    }, {
        "families": [],
        "description": "Connects to smtp.live.com, possibly for spamming or data exfiltration",
        "name": "smtp_live",
        "markcount": 1,
        "references": [],
        "marks": [{
            "category": "domain",
            "type": "ioc",
            "ioc": "smtp.live.com",
            "description": null
        }],
        "severity": 2
    }, {
        "families": [],
        "description": "Connects to smtp.mail.yahoo.com, possibly for spamming or data exfiltration",
        "name": "smtp_yahoo",
        "markcount": 1,
        "references": [],
        "marks": [{
            "category": "domain",
            "type": "ioc",
            "ioc": "smtp.mail.yahoo.com",
            "description": null
        }],
        "severity": 2
    }]
}

Ping

说明

测试连接。

参数

不适用

运行于

此操作会在所有实体上运行。

操作执行结果

脚本结果
脚本结果名称 值选项 示例
is_success True/False is_success:False

需要更多帮助？从社区成员和 Google SecOps 专业人士那里获得解答。