this connector imports knowledge from the Malpedia Library.
The connector adds data for the following OpenCTI observable/indicator types:
- yara
- file-sha256
The connectors adds the following Entities:
- Malware
- Threat Actor
Enabling this connector could be done by launching the Python process directly
after providing the correct configuration in the config.yml file or within a
Docker with the image opencti/connector-malpedia:rolling (replace rolling
with the latest OpenCTI release version for production usage).
We provide an example of docker-compose.yml file that
could be used independently or integrated to the global docker-compose.yml
file of OpenCTI.
The connector can be configured with the following variables:
| Config Parameter | Docker env var | Default | Description |
|---|---|---|---|
base_url |
MALPEDIA_BASE_URL |
https://malpedia.caad.fkie.fraunhofer.de/ |
Base url for the malpedia website. Must end in a "/". |
auth_key |
MALPEDIA_AUTH_KEY |
"" |
API authentication key |
interval_sec |
MALPEDIA_INTERVAL_SEC |
86400 |
Interval in seconds before a new import is considered |
import_actors |
MALPEDIA_IMPORT_ACTORS |
false |
Choose if you want to import Threat Actors from Malpedia |
import_yara |
MALPEDIA_IMPORT_YARA |
false |
Choose if you want to import Yara rules from Malpedia |
update_existing_data |
CONNECTOR_UPDATE_EXISTING_DATA |
false |
This will allow the connector to overwrite existing extries |
confidence_level |
CONNECTOR_CONFIDENCE_LEVEL |
3 |
The confidence level you give to the connector |
The API authentication key. Can be retrieved with a valid account from: https://malpedia.caad.fkie.fraunhofer.de/settings
If you leave this variable undefined or as empty string ("") only public,
TLP:WHITE entities are imported. So this connector can also be used without an
account.
If you choose false for import_actors only references for existing Threat
Actors are imported.
Caution
You should only enable update_existing_data for connectors that you consider
a knowledge priority for the specific entities. Entities created by other
connectors could be overwritten by this.