Skip to content
This repository has been archived by the owner on May 29, 2024. It is now read-only.

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Matthias Vallentin <matthias@tenzir.com>
  • Loading branch information
0snap and mavam committed May 19, 2021
1 parent 55ce3bf commit 58364fd
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 14 deletions.
22 changes: 11 additions & 11 deletions apps/stix-shifter/README.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
STIX-Shifter Threat Bus
=======================

This app bridges the gap between Threat Bus and commercial security tools by
This app bridges the gap between Threat Bus and various security tools by
leveraging
[STIX-Shifter](https://github.com/opencybersecurityalliance/stix-shifter).

STIX-Shifter is a tool and library to transform STIX patterns into native
queries for a variety of (mostly) commercial tools, like
queries for a variety of (mostly commercial) security tools, like
[IBM QRadar](https://www.ibm.com/security/security-intelligence/qradar) or
[Splunk](https://www.splunk.com/). Since Threat Bus itself primarily focuses on
open-source tools, this app now provides a simple way to use intelligence from
Threat Bus with the commercial tools of your choice.
[Splunk](https://www.splunk.com/). This app connects STIX-Shifter with Threat
Bus and provides a simple way to communicate with the commercial tools of your
choice via Threat Bus.

## How It Works

Expand All @@ -19,10 +19,10 @@ connect via ZeroMQ, users must first install and configure the
[`threatbus-zmq-app`](https://pypi.org/project/threatbus-zmq-app/) plugin on
their Threat Bus host.

This app functions as middleman between Threat Bus and commercial security
products. It subscribes to indicator updates from the bus and uses STIX-Shifter
to actively translate STIX-2 intelligence to native queries for commercial
tools. The app then executes these queries via STIX-Shifter. [Result processing
This app functions as middleman between Threat Bus and security tools supported
by STIX-Shifter. It subscribes to indicator updates from the bus and uses
STIX-Shifter to actively translate STIX-2 intelligence to native queries.
The app then executes these queries via STIX-Shifter. [Result processing
is yet to be implemented.]

## Quick Start
Expand Down Expand Up @@ -64,15 +64,15 @@ modules:
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#connection
connection:
host: localhost
port: 8089
port: 8089 # Management port
selfSignedCert: false
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#configuration
transmission:
auth:
username: admin
password: admin123
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#translate
tranlation: {<Any required options specific to the particular data source>}
translation: # {<Any required options specific to the particular data source>}
# The data_source is a STIX-2 DataSource (e.g., an `identity`) and is used
# to create a STIX bundle with the queried results. You configure it here
# and only once for this module.
Expand Down
6 changes: 3 additions & 3 deletions apps/stix-shifter/config.yaml.example
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ logging:
console_verbosity: DEBUG
file: true
file_verbosity: DEBUG
filename: zmq-app-template.log
filename: stix-shifter.log

threatbus: localhost:13370
snapshot: 30
Expand All @@ -16,15 +16,15 @@ modules:
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#connection
connection:
host: localhost
port: 8089
port: 8089 # Management port
selfSignedCert: false
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#configuration
transmission:
auth:
username: admin
password: admin123
# https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#translate
tranlation: {<Any required options specific to the particular data source>}
translation: # {<Any required options specific to the particular data source>}
# The data_source is a STIX-2 DataSource (e.g., an `identity`) and is used
# to create a STIX bundle with the queried results. You configure it here
# and only once for this module.
Expand Down

0 comments on commit 58364fd

Please sign in to comment.