Closed lcia-projects closed 2 years ago
Docker install of OpenCTI, greynoise connection NOT installed.. but shows up under connectors.. takes in data .. queues it up.. but never does anything with it... so it just filles up a queue
Docker-Compose:
version: '3' services: redis: image: redis:6.2.6 restart: always volumes: - redisdata:/data elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.15.1 volumes: - esdata:/usr/share/elasticsearch/data environment: - discovery.type=single-node - xpack.ml.enabled=false restart: always ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 minio: image: minio/minio:RELEASE.2021-10-13T00-23-17Z volumes: - s3data:/data ports: - "9000:9000" environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD} command: server /data healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] interval: 30s timeout: 20s retries: 3 restart: always rabbitmq: image: rabbitmq:3.9-management environment: - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER} - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS} volumes: - amqpdata:/var/lib/rabbitmq restart: always opencti: image: opencti/platform:5.0.3 environment: - NODE_OPTIONS=--max-old-space-size=8096 - APP__PORT=8080 - APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL} - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD} - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN} - APP__APP_LOGS__LOGS_LEVEL=error - REDIS__HOSTNAME=redis - REDIS__PORT=6379 - ELASTICSEARCH__URL=http://elasticsearch:9200 - MINIO__ENDPOINT=minio - MINIO__PORT=9000 - MINIO__USE_SSL=false - MINIO__ACCESS_KEY=${MINIO_ROOT_USER} - MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD} - RABBITMQ__HOSTNAME=rabbitmq - RABBITMQ__PORT=5672 - RABBITMQ__PORT_MANAGEMENT=15672 - RABBITMQ__MANAGEMENT_SSL=false - RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER} - RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS} - SMTP__HOSTNAME=${SMTP_HOSTNAME} - SMTP__PORT=25 - PROVIDERS__LOCAL__STRATEGY=LocalStrategy ports: - "8080:8080" depends_on: - redis - elasticsearch - minio - rabbitmq restart: always worker: image: opencti/worker:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - WORKER_LOG_LEVEL=info depends_on: - opencti deploy: mode: replicated replicas: 3 restart: always connector-history: image: opencti/connector-history:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_HISTORY_ID} # Valid UUIDv4 - CONNECTOR_TYPE=STREAM - CONNECTOR_NAME=History - CONNECTOR_SCOPE=history - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info restart: always depends_on: - opencti connector-export-file-stix: image: opencti/connector-export-file-stix:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4 - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE - CONNECTOR_NAME=ExportFileStix2 - CONNECTOR_SCOPE=application/json - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info restart: always depends_on: - opencti connector-export-file-csv: image: opencti/connector-export-file-csv:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4 - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE - CONNECTOR_NAME=ExportFileCsv - CONNECTOR_SCOPE=text/csv - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info restart: always depends_on: - opencti connector-import-file-stix: image: opencti/connector-import-file-stix:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4 - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE - CONNECTOR_NAME=ImportFileStix - CONNECTOR_SCOPE=application/json,text/xml - CONNECTOR_AUTO=false # Enable/disable auto-import of file - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info restart: always depends_on: - opencti connector-import-report: image: opencti/connector-import-report:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_IMPORT_REPORT_ID} # Valid UUIDv4 - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE - CONNECTOR_NAME=ImportReport - CONNECTOR_SCOPE=application/pdf,text/plain - CONNECTOR_AUTO=false # Enable/disable auto-import of file - CONNECTOR_ONLY_CONTEXTUAL=true # Only extract data related to an entity (a report, a threat actor, etc.) - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info - IMPORT_REPORT_CREATE_INDICATOR=false restart: always depends_on: - opencti connector-abuseipdb: image: opencti/connector-abuseipdb:5.0.3 environment: - OPENCTI_URL=http://opencti:8080 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} - CONNECTOR_ID=${CONNECTOR_ABUSEIPDB_ID} # Valid UUIDv4 - CONNECTOR_TYPE=INTERNAL_ENRICHMENT - CONNECTOR_NAME=AbuseIPDB - CONNECTOR_SCOPE=IPv4-Addr - CONNECTOR_AUTO=true - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted) - CONNECTOR_LOG_LEVEL=info - ABUSEIPDB_API_KEY=${ABUSEIPDB_API_KEY} - ABUSEIPDB_MAX_TLP=TLP:AMBER restart: always volumes: esdata: s3data: redisdata: amqpdata:
Steps to create the smallest reproducible scenario:
if greynoise is automatically loaded, it should enrich the ip4 addresses sent to the system
a giant queue of unprocessed ipv4 addresses
@rhaist can you take a look at this please?
I am a bit confused
greynoise connection NOT installed
If the connector is not installed, it will also not execute anything.
Regards
Closed due to inactivity
Description
Docker install of OpenCTI, greynoise connection NOT installed.. but shows up under connectors.. takes in data .. queues it up.. but never does anything with it... so it just filles up a queue
Environment
Docker-Compose:
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
if greynoise is automatically loaded, it should enrich the ip4 addresses sent to the system
Actual Output
a giant queue of unprocessed ipv4 addresses
Additional information
Screenshots (optional)