Skip to content
This repository has been archived by the owner on May 29, 2024. It is now read-only.

Rewrite CIF3 plugin to convert STIX-2 Indicators #106

Merged
merged 4 commits into from
Mar 22, 2021
Merged

Conversation

0snap
Copy link
Contributor

@0snap 0snap commented Mar 17, 2021

📔 Description

Following up on the STIX-2 rewrite of Threat Bus: this PR updates the CIF3 plugin.

  • Convert STIX-2 Indicators to CIF3 Indicators

📝 Checklist

  • All user-facing changes have changelog entries.
  • The changes are reflected on docs.tenzir.com/threatbus, if necessary.
  • The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

Code review should be enough as this plugin has seen little attention and there are no unit tests, to begin with.

If you want to test interactively:

  • Follow the instructions in the CIF3 plugin's readme to start a CIF3 container and copy the API TOKEN to your Threat Bus config.yaml
  • Send Indicators via Threat Bus and confirm they make their way into CIF3 (e.g., see the logs)

@0snap 0snap requested review from tobim and mavam March 17, 2021 13:51
@0snap 0snap added the feature New functionality label Mar 17, 2021
Copy link
Member

@lava lava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docker build of CIF seems to be currently broken, so I was not able to personally test the plugin changes as described in the instructions.

However, the code itself looks good to me, so I'm approving this PR.

@0snap
Copy link
Contributor Author

0snap commented Mar 22, 2021

I tested this with a local installation of CIF 3 and indicators updates are forwarded to CIF without errors.

@0snap 0snap merged commit 821ba15 into story/ch23320 Mar 22, 2021
@0snap 0snap deleted the story/ch22588 branch March 22, 2021 10:56
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
feature New functionality
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants