Anomali ThreatStream (Beta)
Enrich incoming events with Anomali ThreatStream data
Anomali ThreatStream enrichment is in open beta starting with Panther version 1.85, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Anomali ThreatStream aggregates multiple threat feeds into a single high-fidelity repository by normalizing, deduplicating, removing false positives from, and enriching threat data—then associating all related threat indicators. The Anomali ThreatStream integration is an Enrichment Provider, also known as a Panther-managed Lookup Table.
Anomali ThreatStream enrichment in Panther requires an Anomali ThreatStream license.
By default, Anomali ThreatStream is configured to run against every log source in your Panther environment (yet is possible to disable, if desired). Panther will attempt to match each incoming log event, across all log types, against the Anomali Panther-managed Lookup Table before it passes through the detection engine.
If Panther identifies a match between an incoming event and Anomali entry, Anomali data is appended to the matching log event under a top-level
p_enrichment
key, and able to be referenced in detection logic and searches.For more information on detection writing using an enrichment source, see Writing a detection using Lookup Table data.
An incoming log event is enriched with an Anomali Panther-managed Lookup Table entry (under
p_enrichment
) if a match is found between:- Any of the values of the selector field(s) configured for each associated log type.
- For each log type, the default selectors are its Indicator Fields (represented by
p_any_*
), though the selectors are configurable.
- The value of the
match
key in an Anomali table entry in Panther.match
is the primary key of the Anomali table and is preset by Panther.
- 1.In the upper-right corner of your Panther Console, click> General.
- 2.In the footer at the bottom of the page, find Gateway Public IP.
- Store this value in a secure location, as you'll use it in the next step.
- Follow the Anomali documentation to add your Panther gateway IP address to your Anomali IP allowlist.
To enable the Anomali ThreatStream Enrichment Provider in Panther:
- 1.In the left-hand navigation bar of your Panther Console, click Configure > Enrichment Providers.
- 2.In the upper-right corner, click Create New.
- 3.Click Anomali.
- 4.In the Enrichment Settings form, provide values for the following fields:
- Name: Enter a descriptive name for your integration.
- Anomali subdomain: Enter your Anomali subdomain.
- Username: Enter your Anomali username.
- ThreatStream indicator query: Provide the indicator query that Panther will use to construct the Lookup Table.
- This field's placeholder text shows an example query:
feed_id=42 and status="active"
- It's recommended to test your query in the Anomali ThreatStream interface before providing it to Panther.
- Refresh period (min): Set a refresh period, which determines how often Panther will refresh the Anomali ThreatStream Enrichment Provider data. The default and minimum refresh period is 60 minutes.
- 5.Click Setup.
- 6.On the next page, click Save.
- Your new Anomali ThreatStream configuration will be visible in the Configure > Enrichment Providers page.
Anomali ThreatStream is enabled by default for each log type in your Panther instance.
If you would like to disable (or later enable) Anomali for a certain log type, or alter its selectors:
- 1.In the left-hand navigation bar in your Panther Console, click Configure > Enrichment Providers.
- 2.Within the list of Enrichment Providers, locate the Anomali ThreatStream source you'd like to modify, and click its name.
- 3.On the provider's details page, to the right of the Enriched Log Types header, click Edit.
- If you'd like to enable this Enrichment Provider for a new log type, click Add Log Type.
- In the new row that populates, select a Log Type and, in the Selectors field, at least one event field.
- If you'd like to disable this Enrichment Provider for a log type, locate that log type's row, and click the trash icon.
- If you'd like to alter the selectors for a log type, click into the Selectors field and add or remove selections for event fields.
- 4.In the upper-right corner of the Enriched Log Types tile, click Save.
The below is an example of an Anomali ThreatStream response normalized by Panther, from the query
feed_id=336
:{
"asn": "306",
"can_add_public_tags": true,
"confidence": 50,
"country": "US",
"created_ts": "2023-08-11 10:35:52.302",
"expiration_ts": "2023-11-09 13:35:49",
"feed_id": "336",
"id": "457335623",
"ip": "55.44.33.22",
"is_anonymous": false,
"is_editable": true,
"is_public": false,
"itype": "mal_ip",
"latitude": 37.751,
"longitude": -97.822,
"match": [
"55.44.33.22"
],
"meta": {
"detail2": "imported by user 450",
"severity": "medium"
},
"modified_ts": "2023-08-11 10:35:52.302",
"org": "US Department of Defense Network",
"owner_organization_id": "151",
"p_any_ip_addresses": [
"55.44.33.22"
],
"p_event_time": "2023-08-11 10:35:52.302",
"p_log_type": "Anomali.Indicator",
"p_parse_time": "2023-09-29 17:24:09.176",
"p_row_id": "1a4857af055ca1eb94e79eef1a04",
"p_schema_version": 0,
"resource_uri": "/api/v2/intelligence/457335623/",
"retina_confidence": -1,
"sort": [
1691750152302,
457335623
],
"source": "Panther Dev Feed",
"source_reported_confidence": 50,
"status": "active",
"tags": [
{
"id": "d4j",
"name": "sdk_demo",
"org_id": "151",
"tlp": "white"
}
],
"threat_type": "malware",
"threatscore": 40,
"type": "ip",
"update_id": "1155874106",
"uuid": "0d126865-0b34-4d60-b51b-24083ba53313",
"value": "55.44.33.22"
}
Last modified 1mo ago