From 9b2bfefa56ec1897217ce6eae408f8b994f30e66 Mon Sep 17 00:00:00 2001 From: Felix Date: Wed, 19 May 2021 17:01:44 +0200 Subject: [PATCH] Apply suggestions from code review Co-authored-by: Matthias Vallentin --- apps/stix-shifter/README.md | 22 +++++++++++----------- apps/stix-shifter/config.yaml.example | 6 +++--- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/apps/stix-shifter/README.md b/apps/stix-shifter/README.md index 6d80ac65..ae4b7d0b 100644 --- a/apps/stix-shifter/README.md +++ b/apps/stix-shifter/README.md @@ -1,16 +1,16 @@ STIX-Shifter Threat Bus ======================= -This app bridges the gap between Threat Bus and commercial security tools by +This app bridges the gap between Threat Bus and various security tools by leveraging [STIX-Shifter](https://github.com/opencybersecurityalliance/stix-shifter). STIX-Shifter is a tool and library to transform STIX patterns into native -queries for a variety of (mostly) commercial tools, like +queries for a variety of (mostly commercial) security tools, like [IBM QRadar](https://www.ibm.com/security/security-intelligence/qradar) or -[Splunk](https://www.splunk.com/). Since Threat Bus itself primarily focuses on -open-source tools, this app now provides a simple way to use intelligence from -Threat Bus with the commercial tools of your choice. +[Splunk](https://www.splunk.com/). This app connects STIX-Shifter with Threat +Bus and provides a simple way to communicate with the commercial tools of your +choice via Threat Bus. ## How It Works @@ -19,10 +19,10 @@ connect via ZeroMQ, users must first install and configure the [`threatbus-zmq-app`](https://pypi.org/project/threatbus-zmq-app/) plugin on their Threat Bus host. -This app functions as middleman between Threat Bus and commercial security -products. It subscribes to indicator updates from the bus and uses STIX-Shifter -to actively translate STIX-2 intelligence to native queries for commercial -tools. The app then executes these queries via STIX-Shifter. [Result processing +This app functions as middleman between Threat Bus and security tools supported +by STIX-Shifter. It subscribes to indicator updates from the bus and uses +STIX-Shifter to actively translate STIX-2 intelligence to native queries. +The app then executes these queries via STIX-Shifter. [Result processing is yet to be implemented.] ## Quick Start @@ -64,7 +64,7 @@ modules: # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#connection connection: host: localhost - port: 8089 + port: 8089 # Management port selfSignedCert: false # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#configuration transmission: @@ -72,7 +72,7 @@ modules: username: admin password: admin123 # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#translate - tranlation: {} + translation: # {} # The data_source is a STIX-2 DataSource (e.g., an `identity`) and is used # to create a STIX bundle with the queried results. You configure it here # and only once for this module. diff --git a/apps/stix-shifter/config.yaml.example b/apps/stix-shifter/config.yaml.example index 86c08b1f..00ed8cff 100644 --- a/apps/stix-shifter/config.yaml.example +++ b/apps/stix-shifter/config.yaml.example @@ -3,7 +3,7 @@ logging: console_verbosity: DEBUG file: true file_verbosity: DEBUG - filename: zmq-app-template.log + filename: stix-shifter.log threatbus: localhost:13370 snapshot: 30 @@ -16,7 +16,7 @@ modules: # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#connection connection: host: localhost - port: 8089 + port: 8089 # Management port selfSignedCert: false # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#configuration transmission: @@ -24,7 +24,7 @@ modules: username: admin password: admin123 # https://github.com/opencybersecurityalliance/stix-shifter/blob/master/OVERVIEW.md#translate - tranlation: {} + translation: # {} # The data_source is a STIX-2 DataSource (e.g., an `identity`) and is used # to create a STIX bundle with the queried results. You configure it here # and only once for this module.