Create a STIX Custom Feed

You can create a custom feed using a .csv or STIX formatted feed data file in RSA NetWitness.

Note: NetWitness supports Structured Threat Information Expression (STIX) 1.0, 1.1 and 1.2 versions only. NetWitness supports STIX V2 (2.0 and 2.1) indicators from 12.5 version or later.

Structured Threat Information Expression (STIX™) is a structured language for describing cyber threat information so it can be shared, stored, and analyzed in a consistent manner. For more information about STIX, see https://oasis-open.github.io/cti-documentation/.

Caution: If STIX recurring feed is configured and you update to NetWitness 12.5, you must re-configure the STIX recurring feed.

In NetWitness Platform, STIX feeds are supported.You can upload STIX content in different formats based on its version. For the older versions the format is ".xml". From version 12.5 or later, you can upload in ".json" (STIX V2 indicators) file. The constructs such as Indicator Title and Description, Observable Title and Description, and Indicator Sightings information are parsed from STIX and pushed to the decoders or log decoders that are selected during feed configuration. Information such as IP addresses, File hashes, Domain names, URIs, and Email addresses are extracted from the STIX observable to be included in the feed.

Make sure the following criteria are met before you upload the STIX file:

  1. Only STIX Observables with property values in the "Equals" operator
  2. The uploaded STIX xml file must have only one STIX_Package

TAXII (Trusted Automated eXchange of Indicator Information) is the main transport mechanism for cyber threat information represented in STIX. Using the TAXII services, organizations can share cyber threat information in a secure and automated manner.

The STIX and TAXII communities work closely together to ensure that they continue to provide a full stack for sharing threat intelligence.

Apart from TAXII server, STIX data can also reside on REST server and you can fetch STIX file from the REST server by providing the URL of the REST server. For example, http://stixrestserver.internal.com.

The feed data file (.csv or STIX (.xml)) and optionally the feed definition file (.xml) must be available on the local file system for an on-demand custom feed. For a recurring custom feed, the files must be available at a URL that is accessible to the NetWitness server.

To create a STIX custom feed:

  1. Go to netwitness_configureicon_24x21.png (Configure) > CUSTOM FEEDS.

    The Custom Feeds view is displayed.

    122_CustomFeeds_1122.png

  2. In the toolbar, click netwitness_add.png.

    The Setup Feed dialog is displayed.
    netwitness_setfeed_186x127.png

  3. To select the feed type, click Custom Feed and Next.

    The Configure a Custom Feed wizard is displayed, with the Define Feed dialog open.

    netwitness_def-feed-stix-adhoc_1069x1025.png

  4. Enter the following details:

    1. Feed Type: Select STIX, to define a feed based on a STIX formatted .xml file.
    2. Name: type the feed name, to define a feed based on STIX formatted .xml file.
    3. STIX Source:Select a STIX data source from the drop-down which is added in Context Hub.
    4. Recur Every: Specify a recurring feed task that executes repeatedly at specified intervals.

    Note: NetWitness verifies the connection to the server, so that NetWitness can check for the latest file automatically before each recurrence.

    1. Date Range: Select the checkbox and specify the date range for the feed task to recur.

  5. (Optional) Select Advanced Options,to define a feed based on an XML feed file.

    1. XML Feed file: Browse and select an XML feed file from the local file system.
    2. Separator: Choose a separator (default is comma).
    3. Comment: Specify the comment characters used in the feed data file (default is #).
  6. Click Next.

  7. The Select Services dialog is displayed. This is an example of the form for a feed based on a feed data file with no feed definition file. If you are defining a feed based on a feed definition file, the Define Columns tab is not needed.
    netwitness_selectservstix_581x350.png

  8. To identify services on which to deploy the feed, do one of the following:

    1. Select one or more Decoders and Log Decoders, and click Next.

    2. In case of STIX feed, Context Hub will be selected by default and you are not allowed to deselect it. In addition, you can select one or more Decoders and Log Decoders and click Next or Click the Groups tab and select a group. Click Next.

      If the data from the STIX server is large, the following message is displayed:

      netwitness_110_feedwizwaitmess3.png

      • If you click Continue to Wait, it continues to wait till the sample data is fetched or timeout (10 minutes) whichever is sooner. In case of timeout no sample data is retrieved even after 10 minutes.
      • If you click Map Without Sample data, the mapping column is displayed without any sample data.

      The Define Columns dialog is displayed.

  9. To map columns in the Define Columns form:

    1. Define the Index type: IP, IP Range, or Non IP, and select the index column.
    2. (Optional) If the index type is IP or IP Range and the IP address is in CIDR notation, select CIDR.

    3. (Optional) If the index type is Non IP, additional settings are displayed. Select the service type and Callback Keys, and optionally select the Truncate Domain option.

      netwitness_110_defcol_499x476.png

      Note:
      - If the Index Type is Non IP, you can select multiple index columns in the Index Column(S). The values from all the selected columns are merged in the first index column that you selected and the merged values are pushed to the Log Decoder for parsing. For example, in the Index Column(S) if you select 2,4,7 as index columns the values from the 2,4 and 7 columns are merged in the column 2 and the values are pushed to Log Decoder for parsing.
      - Indexing cannot be done for the columns such as Indicator Title, Indicator Description, Observable Title, Observable Description, as the look up cannot be performed for those columns.

    4. Select the language key to apply to the data in each column from the drop-down list. The meta displayed in the drop-down list is based on the meta available for the service define values. You can also add other meta based on advanced expertise.

    5. Click Next.

      The Review dialog is displayed.

      netwitness_custfdrev_475x341.png

  10. Anytime before you click Finish, you can:

    • Click Cancel to close the wizard without saving your feed definition.
    • Click Reset to clear the data in the wizard.
    • Click Next to display the next dialog (if not viewing the last form).
    • Click Prev to display the previous dialog (if not viewing the first form)
  11. Review the feed information, and if correct, click Finish.
  12. Upon successful creation of the feed definition file, the Create Feed wizard closes, and the feed and corresponding token file are listed in the Feed grid and progress bar tracks completion. You can expand or collapse the entry to see how many services are included, and which services were successful.
raj17_0-1727939063025.png

 

Note: Health and Wellness raises alerts when the available heap memory of Context Hub server is critically low and the status displays as unhealthy due to low memory. For more information on how to troubleshoot the OutOfMemoryError on the Context Hub Server, see "Troubleshooting" in the Live Services Management Guide.