Stamus integration v1.0.0

Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json

@@ -12,7 +12,8 @@
         "Exabeam Incident",
         "Microsoft Sentinel Incident",
         "Graph Security Alert",
-        "CrowdStrike Falcon IDP Detection"
+        "CrowdStrike Falcon IDP Detection",
+        "Stamus Networks DoC"
     ],
     "breachScript": "",
     "caseInsensitive": true,

Packs/Stamus/.secrets-ignore

@@ -0,0 +1,7 @@
+10.11.13.101
+https://10.136.0.72
+10.136.0.72
+10.7.5.101
+95.142.46.236
+https://scs.my.org
+217.116.0.227

Packs/Stamus/Classifiers/classifier-Stamus_Networks_incoming_mapper.json

@@ -0,0 +1,66 @@
+{
+    "description": "Stamus Networks Incoming Mapper",
+    "feed": false,
+    "id": "Stamus Networks incoming mapper",
+    "mapping": {
+        "Stamus Networks DoC": {
+            "dontMapEventToLabels": true,
+            "internalMapping": {
+                "Threat Family Name": {
+                    "simple": "family"
+                },
+                "StamusFamilyDescription": {
+                    "simple": "family_description"
+                },
+                "StamusFamilyID": {
+                    "simple": "family_id"
+                },
+                "StamusFamilyLink": {
+                    "simple": "family_link"
+                },
+                "StamusID": {
+                    "simple": "id"
+                },
+                "StamusKillchain": {
+                    "simple": "kill_chain"
+                },
+                "StamusTarget": {
+                    "simple": "target"
+                },
+                "StamusTargettype": {
+                    "simple": "target_type"
+                },
+                "StamusTenant": {
+                    "simple": "tenant"
+                },
+                "StamusThreatDescription": {
+                    "simple": "threat_description"
+                },
+                "StamusThreatId": {
+                    "simple": "threat_id"
+                },
+                "StamusThreatLink": {
+                    "simple": "threat_link"
+                },
+                "Start Time": {
+                    "simple": "timestamp"
+                },
+                "Threat Name": {
+                    "simple": "threat"
+                }
+            }
+        },
+        "dbot_classification_incident_type_all": {
+            "dontMapEventToLabels": false,
+            "internalMapping": {
+                "StamusThreat": {
+                    "simple": "threat"
+                }
+            }
+        }
+    },
+    "name": "Stamus Networks incoming mapper",
+    "type": "mapping-incoming",
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusFamilyDescription.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamusfamilydescription",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamusfamilydescription",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusFamilyDescription",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusFamilyID.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamusfamilyid",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamusfamilyid",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusFamilyID",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusFamilyLink.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamusfamilylink",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamusfamilylink",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusFamilyLink",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusHostFirstSeen.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamushostfirstseen",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamushostfirstseen",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "Stamus Host First Seen",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "date",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusHostLastSeen.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamushostlastseen",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamushostlastseen",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "Stamus Host Last Seen",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "date",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusHostRoles.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamushostroles",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamushostroles",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "Stamus Host Roles",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusID.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamusid",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamusid",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusID",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusKillchain.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamuskillchain",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamuskillchain",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusKillchain",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}

Packs/Stamus/IncidentFields/incidentfield-StamusTarget.json

@@ -0,0 +1,30 @@
+{
+    "associatedToAll": false,
+    "associatedTypes": [
+        "Stamus Networks DoC"
+    ],
+    "caseInsensitive": true,
+    "cliName": "stamustarget",
+    "closeForm": true,
+    "content": true,
+    "editForm": true,
+    "group": 0,
+    "hidden": false,
+    "id": "incident_stamustarget",
+    "isReadOnly": false,
+    "locked": false,
+    "name": "StamusTarget",
+    "neverSetAsRequired": false,
+    "openEnded": false,
+    "ownerOnly": false,
+    "required": false,
+    "sla": 0,
+    "system": false,
+    "threshold": 72,
+    "type": "shortText",
+    "unmapped": false,
+    "unsearchable": true,
+    "useAsKpi": false,
+    "version": -1,
+    "fromVersion": "6.9.0"
+}