Adversary & Campaign InsightsDetection & Response Enablement
Aperçu
Import IOCs, YARA rules, MITRE ATT&CK references and CVEs extracted by Rösti from public threat reports.
Rösti (Repackaged Öpen Source Threat Intelligence) parses public threat reports from hundreds of security vendors, researchers and CERTs and turns them into machine-readable IOCs, YARA rules and MITRE ATT&CK references. Every IOC carries a false-positive risk score based on about 30 allowlists.
This connector imports Rösti reports into OpenCTI as STIX reports containing:
- indicators and observables for IPs, CIDRs, domains, URLs, email addresses, file hashes (MD5, SHA-1, SHA-256, SHA-512, SSDEEP, SHA-224), file names and paths, mutexes, user agents and cryptocurrency wallets; the Rösti false-positive risk sets the score, Rösti tags become labels and the IDS flag sets detection,
- YARA rules as indicators,
- MITRE ATT&CK techniques, mitigations, groups, campaigns and software,
- CVEs as vulnerabilities.
The connector imports reports created or updated since its last run and resumes from a checkpoint after interruptions.
Informations de base
Connecteurs
7.261030.0
7.261030.0
0
rosti@bin.re