Add threat intel source apis for create delete get search operations #7847

eirsep · 2024-07-26T20:36:27Z

Description

added threat intel source apis for create delete get search operations

Issues Resolved

Closes #7714

Version

2.16

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2024-07-26T20:36:39Z

Thank you for submitting your PR. The PR states are In progress (or Draft) -> Tech review -> Doc review -> Editorial review -> Merged.

Before you submit your PR for doc review, make sure the content is technically accurate. If you need help finding a tech reviewer, tag a maintainer.

When you're ready for doc review, tag the assignee of this PR. The doc reviewer may push edits to the PR directly or leave comments and editorial suggestions for you to address (let us know in a comment if you have a preference). The doc reviewer will arrange for an editorial review.

eirsep · 2024-07-26T21:13:40Z

@AWSHurneyt plz review

AWSHurneyt · 2024-07-26T21:48:06Z

_security-analytics/api-tools/threat-intel/threat-intel-source.md

+   "bucket_name": "threat-intel-s3-test-bucket",
+   "object_key": "alltypess3object",
+   "region": "us-west-2",
+   "role_arn": "arn:aws:iam::248279774929:role/threat_intel_s3_test_role"


Should we instead use a placeholder here like <ROLE_ARN>?

Good point. It's a dummy aws account but will let @Naarcha-AWS and @hdhalter recommned the right practice.

I'm okay with a dummy account, personally.

AWSHurneyt · 2024-07-26T21:49:16Z

_security-analytics/api-tools/threat-intel/threat-intel-source.md

+
+# Threat Intelligence Source Configuration APIs
+
+The following APIs can be used for tasks related to threat intelligence source configurations.


@eirsep Would it be helpful to define what a source is for our purposes?

Started off with the APIs
Once that's done, similar to detectors, I will define entities and detail them out in another commit to this PR

added a page for Threat intel overview plz check

hdhalter

Nice job, @eirsep! I entered a few suggestion so you can see what we are looking for in a more thorough doc review. Thanks.

_security-analytics/api-tools/threat-intel/threat-intel-source.md

hdhalter · 2024-07-26T23:14:50Z

_security-analytics/api-tools/threat-intel/threat-intel-source.md

+
+# Threat Intelligence Source Configuration APIs
+
+The following APIs can be used for tasks related to threat intelligence source configurations.


Suggested change

The following APIs can be used for tasks related to threat intelligence source configurations.

You can use threat intelligence source API to configure tasks related to threat intelligence sources.

_security-analytics/api-tools/threat-intel/threat-intel-source.md

hdhalter · 2024-07-26T23:17:10Z

_security-analytics/api-tools/threat-intel/threat-intel-source.md

+---
+## Create Threat intel source API
+
+Creates a new threat intel source.


Suggested change

Creates a new threat intel source.

The following command creates a new threat intelligence source.

_security-analytics/api-tools/threat-intel/threat-intel-source.md

eirsep · 2024-07-27T01:21:56Z

@AWSHurneyt what documentation should we add related to the S3 Role ARN on what needs to be configured?

eirsep · 2024-07-30T22:34:40Z

@AWSHurneyt @Naarcha-AWS plz review

Signed-off-by: Surya Sashank Nistala <[email protected]>

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Signed-off-by: Surya Sashank Nistala <[email protected]>

Naarcha-AWS · 2024-08-05T14:43:34Z

Closing in favor of #7905

eirsep requested review from hdhalter, kolchfa-aws, Naarcha-AWS, vagimeli, AMoo-Miki, natebower, dlvenable, stephen-crawford and epugh as code owners July 26, 2024 20:36

eirsep marked this pull request as draft July 26, 2024 20:36

github-actions bot assigned hdhalter Jul 26, 2024

eirsep force-pushed the threat-intel branch from 3b97c4e to 69ea674 Compare July 26, 2024 20:43

kkhatua added the v2.16.0 label Jul 26, 2024

eirsep force-pushed the threat-intel branch from 69ea674 to 7438eaf Compare July 26, 2024 21:11

hdhalter added 3 - Tech review PR: Tech review in progress release-notes PR: Include this PR in the automated release notes labels Jul 26, 2024

AWSHurneyt reviewed Jul 26, 2024

View reviewed changes

hdhalter reviewed Jul 26, 2024

View reviewed changes

Naarcha-AWS self-assigned this Jul 27, 2024

eirsep marked this pull request as ready for review July 29, 2024 21:21

eirsep force-pushed the threat-intel branch from c1cad37 to 0c57514 Compare July 29, 2024 21:22

hdhalter added 4 - Doc review PR: Doc review in progress and removed 3 - Tech review PR: Tech review in progress labels Jul 29, 2024

hdhalter changed the title ~~added threat intel source apis for create delete get search operations~~ Add threat intel source apis for create delete get search operations Jul 29, 2024

eirsep force-pushed the threat-intel branch from 0c57514 to 24d4b2d Compare July 30, 2024 09:16

hdhalter removed their assignment Jul 30, 2024

eirsep and others added 14 commits August 1, 2024 10:23

added threat intel source apis for create delete get search operations

d004861

Signed-off-by: Surya Sashank Nistala <[email protected]>

add threat intel findings and alerts APIs

053a4a1

Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

4b86238

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

db61dbc

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

674b1d8

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

08dd633

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

757d97c

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

56a1579

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

209ce29

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

Update _security-analytics/api-tools/threat-intel/threat-intel-source.md

8061ff3

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]>

change the word intel to intelligence across files

3ac502b

Signed-off-by: Surya Sashank Nistala <[email protected]>

threat intel monitors apis

02f49eb

Signed-off-by: Surya Sashank Nistala <[email protected]>

add threat intelligence analytics overview documentation

e3d7111

Signed-off-by: Surya Sashank Nistala <[email protected]>

adds threat intel iocs example file for S3 or local file upload

f8efffc

Signed-off-by: Surya Sashank Nistala <[email protected]>

eirsep force-pushed the threat-intel branch from 2b632ea to f8efffc Compare August 1, 2024 17:23

Merge branch 'main' into threat-intel

40b13a5

Naarcha-AWS mentioned this pull request Aug 5, 2024

Add Threat Intelligence Section #7905

Merged

1 task

Naarcha-AWS closed this Aug 5, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add threat intel source apis for create delete get search operations #7847

Add threat intel source apis for create delete get search operations #7847

eirsep commented Jul 26, 2024 •

edited by hdhalter

Loading

github-actions bot commented Jul 26, 2024

eirsep commented Jul 26, 2024

AWSHurneyt Jul 26, 2024

eirsep Jul 27, 2024

Naarcha-AWS Jul 30, 2024

AWSHurneyt Jul 26, 2024

eirsep Jul 27, 2024

eirsep Jul 30, 2024

hdhalter left a comment

hdhalter Jul 26, 2024

hdhalter Jul 26, 2024

eirsep commented Jul 27, 2024

eirsep commented Jul 30, 2024

Naarcha-AWS commented Aug 5, 2024


		# Threat Intelligence Source Configuration APIs

		The following APIs can be used for tasks related to threat intelligence source configurations.

	The following APIs can be used for tasks related to threat intelligence source configurations.
	You can use threat intelligence source API to configure tasks related to threat intelligence sources.

	Creates a new threat intel source.
	The following command creates a new threat intelligence source.

Add threat intel source apis for create delete get search operations #7847

Add threat intel source apis for create delete get search operations #7847

Conversation

eirsep commented Jul 26, 2024 • edited by hdhalter Loading

Description

Issues Resolved

Version

Checklist

github-actions bot commented Jul 26, 2024

eirsep commented Jul 26, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hdhalter left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eirsep commented Jul 27, 2024

eirsep commented Jul 30, 2024

Naarcha-AWS commented Aug 5, 2024

eirsep commented Jul 26, 2024 •

edited by hdhalter

Loading