Version 1.0.5

• Remove traceback from logs in case of 404 error

Version 1.0.4

• Logging improvement
• Make human-readable error messages

Version 1.0.3

• Remove unused endpoints

Version 1.0.2

• Update dependencies management

Version 1.0.1

• Fixed bug when host is empty

Cisco Hosted Relay

v1.0.0

Sumo Logic Log Management

The new Sumo Logic Log Management integration indicates to users that the observable in an investigation is contained in a log message within Sumo Logic. It provides users with the date and time the observable was seen in the log, the collector that received the log, and the log source that provided the message.

This integration allows you to query IPv4, IPv6, SHA-1, SHA-256, MD5, domain, and URL data types and it returns verdicts and judgements from Sumo Logic's query to CrowdStrike Intelligence. Additionally, each log message returns sightings of an observable.

Implementation Details

This application was developed and tested under Python version 3.9.

Implemented Relay Endpoints

• POST /health

  • Verifies the Authorization Bearer JWT and decodes it to restore the
    original credentials.
  • Authenticates to the underlying external service to check that the provided
    credentials are valid and the service is available at the moment.

• POST /deliberate/observables

  • Accepts a list of observables and filters out unsupported ones.
  • Verifies the Authorization Bearer JWT and decodes it to restore the
    original credentials.
  • Makes a series of requests to the underlying external service to query for
    some cyber threat intelligence data on each supported observable.
  • Maps the fetched data into appropriate CTIM entities.
  • Returns a list per each of the following CTIM entities (if any extracted):
    • Verdict.

• POST /observe/observables

  • Accepts a list of observables and filters out unsupported ones.
  • Verifies the Authorization Bearer JWT and decodes it to restore the
    original credentials.
  • Makes a series of requests to the underlying external service to query for
    some cyber threat intelligence data on each supported observable.
  • Maps the fetched data into appropriate CTIM entities.
  • Returns a list per each of the following CTIM entities (if any extracted):
    • Verdict,
    • Judgment,
    • Sighting.

• POST /refer/observables

  • Accepts a list of observables and filters out unsupported ones.
  • Builds a search link per each supported observable to pivot back to the
    underlying external service and look up events with the observable there.
  • Returns a list of those links.

• POST /version

  • Returns the current version of the application.

Supported Types of Observables

All types allowed in CTIM

CTIM Mapping Specifics

Each response from the Sumo Logic API for the supported observables generates the following CTIM entities:

• Sightings are taken from each message in Sumo Logic response.

• Verdicts and Judgements are taken from separate request to Sumo Logic with query to CrowdStrike Intelligence.

• severity of Judgement is mapped from malicious_confidence in message from Sumo Logic/CrowdStrike:

  malicious_confidence	Severity
  high	High
  medium	Medium
  low	Low
  unverified	Unknown

• disposition of Judgement is mapped from malicious_confidence in message from Sumo Logic/CrowdStrike:

  malicious_confidence	Disposition	Disposition Name
  high	2	Malicious
  medium	2	Malicious
  low	3	Suspicious
  unverified	5	Unknown