Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Additionally, if a special text file named .stix_input.txt is found in ./zeek/intel/STIX, that file will be read and processed as a list of TAXII™2.0/2.1 feeds, one per line, according to the following format:
Malcolm will attempt to query the TAXII feed(s) for indicator STIX objects and convert them to the Zeek intelligence format as described above. There are publicly available TAXII 2.x-compatible services provided by a number of organizations including Anomali Labs and MITRE, or you may choose from several open-source offerings to roll your own TAXII 2 server (e.g., oasis-open/cti-taxii-server, freetaxii/server, StephenOTT/TAXII-Server, etc.).
Note that only indicators of cyber-observable objects matched with the equals (=)comparison operator against a single value can be expressed as Zeek intelligence items. More complex STIX indicators will be silently ignored.
mmguero
commented
2 years ago
In conjunction with Malcolm's use of Zeek Intelligence framework:
... on startup Malcolm will automatically generate a Zeek intelligence file for all Structured Threat Information Expression (STIX™) v2.0/v2.1 JSON files found under
./zeek/intel/STIX.Additionally, if a special text file named
.stix_input.txtis found in./zeek/intel/STIX, that file will be read and processed as a list of TAXII™ 2.0/2.1 feeds, one per line, according to the following format:For example:
Malcolm will attempt to query the TAXII feed(s) for
indicatorSTIX objects and convert them to the Zeek intelligence format as described above. There are publicly available TAXII 2.x-compatible services provided by a number of organizations including Anomali Labs and MITRE, or you may choose from several open-source offerings to roll your own TAXII 2 server (e.g., oasis-open/cti-taxii-server, freetaxii/server, StephenOTT/TAXII-Server, etc.).Note that only indicators of cyber-observable objects matched with the equals (
=) comparison operator against a single value can be expressed as Zeek intelligence items. More complex STIX indicators will be silently ignored.