[ImportExternalUrl] Create the connector

[Fred-certeu]

Import public threat reports from open sources blogs.

• The html page should be transformed in to an OpenCTI report
• The URL of the page should be transformed into an external reference
• If the page contains tags (i.e. related to malware families, threat actors, countries, intrusion sets) automatic associations should be made in OpenCTI

For each blog, there could be two different work flows:

1. Select mode = Select one by one the blog posts to be imported, from any source (page as report and url as a external reference)

OR

2. Subscription mode = Get automatically all posts from a specific blog (page as report and url as external reference). Validate or validate the posts that the analyst want to keep.

Examples of open sources blogs :

IT security news aggregators such as:

• Security affairs
• Bleeping computer
• ZDNet
• ThreatPost
• etc

IT security vendor owned blogs:

• Kaspersky securelist
• ESET
• Trendlabs
• etc

[rhaist]

The connector could also use the excellent tooling around APTnotes: https://github.com/aptnotes/tools

[Fred-certeu]

Thank you for the link. It is useful and complementary. My point is more specifically to create reports to track recent noteworthy incidents by open sources (even if there is no observables / IOCs).

For example, I would like to transform the following posts into openCTI reports:

https://www.bleepingcomputer.com/news/security/brooklyn-hospital-loses-patient-data-in-ransomware-attack/ country : US sector : health category : cybercrime tactics : extortion, big game hunting

https://www.bleepingcomputer.com/news/security/ransomware-attacks-hit-everis-and-spains-largest-radio-network/ country : Spain sector : managed service provider, radio broadcasting category : cybercrime tactics : extortion, big game hunting malware : Bitpaymer

[rhaist]

I think we might be able to achieve this by using RSS. E.g. with feedparser

[OzRex08]

Any progress on this connector? It would be a great idea!

[SamuelHassine]

This connector has been implemented as the "Import External Reference". Any external reference containing a URL can now be downloaded as PDF or Markdown file, anywhere in the platform.

[SamuelHassine]