ThreatQ - Zeek Exports¶
These steps explain how to export Zeek indicators for use with an external threat detection system. Follow the instructions below to export your data.
Select the Settings icon > Exports.
The Exports page appears with a table listing all exports in alphabetical order.
Click Add New Export.
The Connection Settings dialog box appears.
Enter an Export Name.
Click Next Step.
The Output Format dialog box appears.
5. Provide the following information: *Note that you can edit the output format as desired. This includes the ability to remove unwanted indicator types.
FIELD | VALUE |
---|---|
Which type of informationwould you like to export? | Indicators |
Output Type | text/plain |
Special Parameters | indicator.status=Active&indicator.deleted=N |
Under Output Format Template, enter:
#fields{$tab}indicator{$tab}indicator_type{$tab}meta.source{$tab}meta.url {foreach $data as $indicator} {$indicator_type=""} {$source_found=0} {if $indicator.type eq "CIDR Block"}{$indicator_type="Intel::SUBNET"}{/if} {if $indicator.type eq "IP Address"}{$indicator_type="Intel::ADDR"}{/if} {if $indicator.type eq "URL"}{$indicator_type="Intel::URL"}{/if} {if $indicator.type eq "Email Address"}{$indicator_type="Intel::EMAIL"}{/if} {if $indicator.type eq "FQDN"}{$indicator_type="Intel::DOMAIN"}{/if} {if $indicator.type eq "MD5"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-1"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-256"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-384"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "SHA-512"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator.type eq "Filename"}{$indicator_type="Intel::FILE_HASH"}{/if} {if $indicator_type ne ""} {$indicator.value}{$tab}{$indicator_type}{$tab}{foreach $indicator.Sources item=source name=Sources}{if $smarty.foreach.Sources.first == true} {$source.value}{$source_found=1}{/if}{/foreach}{if $source_found == 0}-{/if} {$tab}https://{$http_host}/indicators/{$indicator.id}/details {/if} {/foreach}
Click Save Settings.
Under On/Off, toggle the switch to enable the export.
After this is finished, you simply hit the URL and download the intel data in Zeek format.