Skip to content

Latest commit

 

History

History
 
 

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 
 
 
 
 

Readme.md

OpenCTI Malpedia Connector

this connector imports knowledge from the Malpedia Library.

The connector adds data for the following OpenCTI observable/indicator types:

  • yara
  • file-sha256

The connectors adds the following Entities:

  • Malware
  • Threat Actor

Installation

Enabling this connector could be done by launching the Python process directly after providing the correct configuration in the config.yml file or within a Docker with the image opencti/connector-malpedia:rolling (replace rolling with the latest OpenCTI release version for production usage).

We provide an example of docker-compose.yml file that could be used independently or integrated to the global docker-compose.yml file of OpenCTI.

Configuration

The connector can be configured with the following variables:

Config Parameter Docker env var Default Description
base_url MALPEDIA_BASE_URL https://malpedia.caad.fkie.fraunhofer.de/ Base url for the malpedia website. Must end in a "/".
auth_key MALPEDIA_AUTH_KEY "" API authentication key
interval_sec MALPEDIA_INTERVAL_SEC 86400 Interval in seconds before a new import is considered
import_actors MALPEDIA_IMPORT_ACTORS false Choose if you want to import Threat Actors from Malpedia
import_yara MALPEDIA_IMPORT_YARA false Choose if you want to import Yara rules from Malpedia
update_existing_data CONNECTOR_UPDATE_EXISTING_DATA false This will allow the connector to overwrite existing extries
confidence_level CONNECTOR_CONFIDENCE_LEVEL 3 The confidence level you give to the connector

Notes

The API authentication key. Can be retrieved with a valid account from: https://malpedia.caad.fkie.fraunhofer.de/settings

If you leave this variable undefined or as empty string ("") only public, TLP:WHITE entities are imported. So this connector can also be used without an account.

If you choose false for import_actors only references for existing Threat Actors are imported.

Caution

You should only enable update_existing_data for connectors that you consider a knowledge priority for the specific entities. Entities created by other connectors could be overwritten by this.