Infection Alerts Integration Guide

Ingrid

1 About

python setup.py install

Under normal network performance, and using common grade processors and memory:

The script will get Infections Alerts events from Bitsight and convert the JSON data into CEF or LEEF formats.

Variable	Details
`OUTPUT_FORMAT`	Defines the output format of the data. Can be one of: `OUTPUT_FORMAT = 'CEF'` `OUTPUT_FORMAT = 'LEEF'`
`SYSLOG_DST_IP`	IP address of the Syslog server.
`SYSLOG_DST_PORT`	Port of the Syslog server.
`APIKEY`	Infections Alerts API token. Provided by Bitsight.
`ENDPOINT`	Provided by Bitsight. This defaults to: `https://alerts.api.bitsighttech.com`
`FILTERS`	Add filters to the API request. Example: For the “`maxbytes=1`” filter `('maxbytes', '1')`
`DEBUG`	No output: `OFF` Output the queue size: `DEBUG_JSON_QUEUE` Output CEF/LEEF: `DEBUG_OUT` Output Syslog messages to a file: `DEBUG_SYSLOG` Set pyCurl to VERBOSE mode: `VERBOSE`

$ python json2cefleef.py

Fields	Key Name	Full Name	Data Type	Size
env.remote_addr	src	sourceAddress	IPV4 Address
env.remote_port	spt	sourcePort	sourcePort
env.server_name	dhost	destinationHostName	String	1023
env.server_addr	dst	destinationAddress	IPv4 Address
env.server_port	dpt	destinationPort	Integer
env.request_method	requestMethod	requestMethod	String	1023
_ts	rt	receiptTime	Time Stamp
trojanfamily	cs1	deviceCustomString1	String	1023
_geo_env_remote_addr.country_name	cs3	deviceCustomString3	String	1023

Key Name	Full Name	Label
cs1Label	deviceCustomString1Label	trojanFamily
cs3Label	deviceCustomString3Label	geoEnvRemoteAddrCountry Name

Fields	Key Name	Data Type	Size
env.remote_addr	src	IPV4 Address
env.remote_port	srcPort	sourcePort
env.server_name	dhost	String	1023
env.server_addr	dst	IPv4 Address
env.server_port	dstPort	Integer
env.request_method	requestMethod	String	1023
_ts	devTime	Time Stamp
trojanfamily	trojanFamily	String	1023
_geo_env_remote_addr.country_name	geoEnvRemoteAddrCountryName	String	1023