Skip to content

Commit 0ee1edf

Browse files
throuxelthrouxel
committed
[sublime] update to be manager supported
1 parent 33b778a commit 0ee1edf

7 files changed

Lines changed: 187 additions & 68 deletions

File tree

‎external-import/sublime/README.md‎

Lines changed: 7 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -28,38 +28,13 @@ Example details added to an event incident:
2828

2929
## Installation
3030

31-
### Configuration
32-
33-
Use the provided Docker Compose example to configure the connector inside your existing OpenCTI deployment.
34-
Add the environment variables below to your OpenCTI `docker-compose.yml` under the connector service.
35-
36-
Required environment variables in `docker-compose.yml`:
37-
38-
```yaml
39-
environment:
40-
- OPENCTI_URL=http://opencti:8080
41-
- OPENCTI_TOKEN=ChangeMe
42-
43-
- CONNECTOR_ID=ChangeMe
44-
- CONNECTOR_NAME=Sublime Security Incidents
45-
- CONNECTOR_SCOPE=sublime
46-
- CONNECTOR_LOG_LEVEL=info
47-
- CONNECTOR_DURATION_PERIOD=PT3M # ISO 8601 duration (PT10M = 10 minutes)
48-
49-
- SUBLIME_URL=https://platform.sublime.security
50-
- SUBLIME_TOKEN=ChangeMe
51-
- SUBLIME_INCIDENT_TYPE=phishing # STIX incident type
52-
- SUBLIME_INCIDENT_PREFIX=Sublime Incident -
53-
- SUBLIME_CASE_PREFIX=Sublime -
54-
- SUBLIME_AUTO_CREATE_CASES=false # Automatically create cases for incidents
55-
- SUBLIME_VERDICTS=malicious # Multiple verdicts can be comma-separated: malicious,suspicious
56-
- SUBLIME_SET_PRIORITY=true # Enable priority mapping from attack score verdict
57-
- SUBLIME_SET_SEVERITY=false # Enable severity mapping from attack score verdict
58-
- SUBLIME_CONFIDENCE_LEVEL=80 # 0-100 confidence score
59-
- SUBLIME_FIRST_RUN_DURATION=PT8H # Duration for initial data fetch in ISO 8601 format (P14D = 14 days, PT1H = 1 hour)
60-
- SUBLIME_FORCE_HISTORICAL=false # Force historical fetch by overriding existing state
61-
- SUBLIME_BATCH_SIZE=100 # Number of message groups to process per batch (default: 100)
62-
```
31+
## Configuration
32+
33+
Find all the configuration variables available here: [Connector Configurations](./__metadata__/CONNECTOR_CONFIG_DOC.md)
34+
35+
_The `opencti` and `connector` options in the `docker-compose.yml` and `config.yml` are the same as for any other connector.
36+
For more information regarding variables, please refer to [OpenCTI's documentation on connectors](https://docs.opencti.io/latest/deployment/connectors/)._
37+
6338

6439
### Deployment
6540

@@ -80,36 +55,6 @@ Monitor connector logs:
8055
docker compose logs -f connector-sublime
8156
```
8257

83-
## Configuration Reference
84-
85-
### Required Variables
86-
87-
| Variable | Description |
88-
|----------|-------------|
89-
| `OPENCTI_URL` | OpenCTI platform URL |
90-
| `OPENCTI_TOKEN` | OpenCTI API authentication token |
91-
| `CONNECTOR_ID` | Unique identifier for this connector instance |
92-
| `CONNECTOR_NAME` | Display name for the connector (`Sublime Security Incidents`) |
93-
| `CONNECTOR_SCOPE` | Connector scope identifier |
94-
| `SUBLIME_URL` | Sublime platform URL for API connections |
95-
| `SUBLIME_TOKEN` | Sublime Security API authentication token |
96-
97-
### Optional Variables
98-
99-
| Variable | Default | Description |
100-
|----------|---------|-------------|
101-
| `CONNECTOR_DURATION_PERIOD` | `PT3M` | Polling interval (ISO 8601 duration format) |
102-
| `SUBLIME_INCIDENT_TYPE` | `phishing` | Label to apply to incident type |
103-
| `SUBLIME_INCIDENT_PREFIX` | `Sublime Incident - ` | Prefix for incident object names |
104-
| `SUBLIME_CASE_PREFIX` | `Case - ` | Prefix for case object names |
105-
| `SUBLIME_AUTO_CREATE_CASES` | `false` | Automatically create investigation cases |
106-
| `SUBLIME_VERDICTS` | `malicious` | Comma-separated attack score verdicts to process |
107-
| `SUBLIME_FIRST_RUN_DURATION` | `PT8H` | ISO 8601 duration for initial data fetch on first run |
108-
| `SUBLIME_FORCE_HISTORICAL` | `false` | Force historical fetch ignoring existing state for correcting improper states |
109-
| `SUBLIME_SET_PRIORITY` | `true` | Enable priority mapping from attack score |
110-
| `SUBLIME_SET_SEVERITY` | `true` | Enable severity mapping from attack score |
111-
| `SUBLIME_BATCH_SIZE` | `100` | Number of messages per processing batch |
112-
11358
## API Token Configuration
11459

11560
### Sublime Security API Token

‎external-import/sublime/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | The API token to connect to OpenCTI. |
11+
| SUBLIME_TOKEN | `string` | ✅ | Format: [`password`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | Sublime Security API authentication token. |
12+
| CONNECTOR_NAME | `string` | | string | `"Sublime Security"` | The name of the connector. |
13+
| CONNECTOR_SCOPE | `array` | | string | `["sublime"]` | The scope or type of data the connector is importing, either a MIME type or Stix Object (for information only). |
14+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
15+
| CONNECTOR_TYPE | `const` | | `EXTERNAL_IMPORT` | `"EXTERNAL_IMPORT"` | |
16+
| CONNECTOR_DURATION_PERIOD | `string` | | Format: [`duration`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"PT3M"` | The period of time to await between two runs of the connector. |
17+
| SUBLIME_URL | `string` | | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"https://platform.sublime.security"` | Sublime platform URL for API connections. |
18+
| SUBLIME_INCIDENT_TYPE | `string` | | string | `"phishing"` | Label to apply to incident type. |
19+
| SUBLIME_INCIDENT_PREFIX | `string` | | string | `"Sublime Incident - "` | Prefix for incident object names. |
20+
| SUBLIME_CASE_PREFIX | `string` | | string | `"Case - "` | Prefix for case object names. |
21+
| SUBLIME_AUTO_CREATE_CASES | `boolean` | | boolean | `false` | Automatically create investigation cases. |
22+
| SUBLIME_VERDICTS | `array` | | string | `["malicious"]` | Comma-separated attack score verdicts to process. |
23+
| SUBLIME_SET_PRIORITY | `boolean` | | boolean | `true` | Enable priority mapping from attack score. |
24+
| SUBLIME_SET_SEVERITY | `boolean` | | boolean | `true` | Enable severity mapping from attack score. |
25+
| SUBLIME_FIRST_RUN_DURATION | `string` | | Format: [`duration`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"PT8H"` | ISO 8601 duration for initial data fetch on first run. |
26+
| SUBLIME_FORCE_HISTORICAL | `boolean` | | boolean | `false` | Force historical fetch ignoring existing state for correcting improper states. |
27+
| SUBLIME_BATCH_SIZE | `integer` | | integer | `100` | Number of messages per processing batch. |
28+
| SUBLIME_TLP_LEVEL | `string` | | `clear` `white` `green` `amber` `amber+strict` `red` | `"amber"` | TLP marking level applied to created STIX entities. |

‎external-import/sublime/__metadata__/connector_config_schema.json‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://www.filigran.io/connectors/sublime_config.schema.json",
4+
"type": "object",
5+
"properties": {
6+
"OPENCTI_URL": {
7+
"description": "The base URL of the OpenCTI instance.",
8+
"format": "uri",
9+
"maxLength": 2083,
10+
"minLength": 1,
11+
"type": "string"
12+
},
13+
"OPENCTI_TOKEN": {
14+
"description": "The API token to connect to OpenCTI.",
15+
"type": "string"
16+
},
17+
"CONNECTOR_NAME": {
18+
"default": "Sublime Security",
19+
"description": "The name of the connector.",
20+
"type": "string"
21+
},
22+
"CONNECTOR_SCOPE": {
23+
"default": [
24+
"sublime"
25+
],
26+
"description": "The scope or type of data the connector is importing, either a MIME type or Stix Object (for information only).",
27+
"items": {
28+
"type": "string"
29+
},
30+
"type": "array"
31+
},
32+
"CONNECTOR_LOG_LEVEL": {
33+
"default": "error",
34+
"description": "The minimum level of logs to display.",
35+
"enum": [
36+
"debug",
37+
"info",
38+
"warn",
39+
"warning",
40+
"error"
41+
],
42+
"type": "string"
43+
},
44+
"CONNECTOR_TYPE": {
45+
"const": "EXTERNAL_IMPORT",
46+
"default": "EXTERNAL_IMPORT",
47+
"type": "string"
48+
},
49+
"CONNECTOR_DURATION_PERIOD": {
50+
"default": "PT3M",
51+
"description": "The period of time to await between two runs of the connector.",
52+
"format": "duration",
53+
"type": "string"
54+
},
55+
"SUBLIME_URL": {
56+
"default": "https://platform.sublime.security",
57+
"description": "Sublime platform URL for API connections.",
58+
"format": "uri",
59+
"maxLength": 2083,
60+
"minLength": 1,
61+
"type": "string"
62+
},
63+
"SUBLIME_TOKEN": {
64+
"description": "Sublime Security API authentication token.",
65+
"format": "password",
66+
"type": "string",
67+
"writeOnly": true
68+
},
69+
"SUBLIME_INCIDENT_TYPE": {
70+
"default": "phishing",
71+
"description": "Label to apply to incident type.",
72+
"type": "string"
73+
},
74+
"SUBLIME_INCIDENT_PREFIX": {
75+
"default": "Sublime Incident - ",
76+
"description": "Prefix for incident object names.",
77+
"type": "string"
78+
},
79+
"SUBLIME_CASE_PREFIX": {
80+
"default": "Case - ",
81+
"description": "Prefix for case object names.",
82+
"type": "string"
83+
},
84+
"SUBLIME_AUTO_CREATE_CASES": {
85+
"default": false,
86+
"description": "Automatically create investigation cases.",
87+
"type": "boolean"
88+
},
89+
"SUBLIME_VERDICTS": {
90+
"default": [
91+
"malicious"
92+
],
93+
"description": "Comma-separated attack score verdicts to process.",
94+
"items": {
95+
"type": "string"
96+
},
97+
"type": "array"
98+
},
99+
"SUBLIME_SET_PRIORITY": {
100+
"default": true,
101+
"description": "Enable priority mapping from attack score.",
102+
"type": "boolean"
103+
},
104+
"SUBLIME_SET_SEVERITY": {
105+
"default": true,
106+
"description": "Enable severity mapping from attack score.",
107+
"type": "boolean"
108+
},
109+
"SUBLIME_FIRST_RUN_DURATION": {
110+
"default": "PT8H",
111+
"description": "ISO 8601 duration for initial data fetch on first run.",
112+
"format": "duration",
113+
"type": "string"
114+
},
115+
"SUBLIME_FORCE_HISTORICAL": {
116+
"default": false,
117+
"description": "Force historical fetch ignoring existing state for correcting improper states.",
118+
"type": "boolean"
119+
},
120+
"SUBLIME_BATCH_SIZE": {
121+
"default": 100,
122+
"description": "Number of messages per processing batch.",
123+
"type": "integer"
124+
},
125+
"SUBLIME_TLP_LEVEL": {
126+
"description": "TLP marking level applied to created STIX entities.",
127+
"enum": [
128+
"clear",
129+
"white",
130+
"green",
131+
"amber",
132+
"amber+strict",
133+
"red"
134+
],
135+
"type": "string",
136+
"default": "amber"
137+
}
138+
},
139+
"required": [
140+
"OPENCTI_URL",
141+
"OPENCTI_TOKEN",
142+
"SUBLIME_TOKEN"
143+
],
144+
"additionalProperties": true
145+
}

‎external-import/sublime/__metadata__/connector_manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"support_version": ">=6.8.12",
1616
"subscription_link": "https://sublime.security/",
1717
"source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/sublime",
18-
"manager_supported": false,
18+
"manager_supported": true,
1919
"container_version": "rolling",
2020
"container_image": "opencti/connector-sublime",
2121
"container_type": "EXTERNAL_IMPORT"

external-import/sublime/src/config.yml.sample renamed to external-import/sublime/config.yml.sample

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ opencti:
99

1010
# Connector Configuration
1111
connector:
12-
# type: 'EXTERNAL_IMPORT'
13-
# Must match CONNECTOR_ID in docker-compose.yml if you use both
14-
id: "ChangeMe" # Required
12+
# id: "d5003f91-27b0-4b4e-995d-a4b9a8a970a4"
1513
# name: "Sublime Security Incidents"
1614
# scope: "sublime"
1715
# log_level: "error"
@@ -35,4 +33,5 @@ sublime:
3533

3634
# first_run_duration: "PT8H" # Duration for initial data fetch in ISO 8601 format
3735
# force_historical: false # Force historical fetch by overriding existing state
38-
# batch_size: 100 # Number of message groups to process per batch (default: 100)
36+
# batch_size: 100 # Number of message groups to process per batch (default: 100)
37+
# tlp_level: "amber"

‎external-import/sublime/docker-compose.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services:
55
environment:
66
- OPENCTI_URL=http://localhost
77
- OPENCTI_TOKEN=ChangeMe
8-
- CONNECTOR_ID=ChangeMe
8+
# - CONNECTOR_ID=d5003f91-27b0-4b4e-995d-a4b9a8a970a4
99
# - CONNECTOR_NAME=Sublime Security
1010
# - CONNECTOR_SCOPE=sublime
1111
# - CONNECTOR_LOG_LEVEL=error
@@ -22,4 +22,5 @@ services:
2222
# - SUBLIME_FIRST_RUN_DURATION=PT8H
2323
# - SUBLIME_FORCE_HISTORICAL=false
2424
# - SUBLIME_BATCH_SIZE=100
25+
# - SUBLIME_TLP_LEVEL=amber
2526
restart: always

‎external-import/sublime/src/connector/sublime_connector.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1151,6 +1151,7 @@ def _process_message_batch(self, messages, work_id):
11511151
stix_objects_bundle,
11521152
work_id=work_id,
11531153
update=True,
1154+
cleanup_inconsistent_bundle=True,
11541155
)
11551156
self.helper.connector_logger.debug(
11561157
"[Sublime Connector] Bundle sent successfully for incident",

0 commit comments

Comments
 (0)