Admin Guide

Synapse-AlienVault Admin Guide

Configuration

Synapse-AlienVault requires a AlienVault API key. For information on how to signup, please visit the AlienVault API documentation.

Setting the configuration for global use

To set-up a global configuration:

> alienvault.config.add default myapikey
synapse-alienvault config "default" added

The API key is validated with AlienVault when a configuration is added or updated. Use --no-check-apikey to skip the validation.

Creating a configuration for role-based use

Add an unscoped configuration:

> alienvault.config.add myunscoped myapikey --scope unscoped
synapse-alienvault config "myunscoped" added

Grant another user admin permissions to the new configuration:

> alienvault.config.update myunscoped --perm user visi admin --no-check-apikey
Updated synapse-alienvault config "myunscoped"

Grant a role read permissions to the new configuration:

> alienvault.config.update myunscoped --perm role ninjas read --no-check-apikey
Updated synapse-alienvault config "myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.alienvault.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Authenticating to the proxy

A configuration with a proxy URL may also provide credentials for the proxy:

> alienvault.config.update myunscoped --proxy http://proxy.vertex.link:3128 --proxy-user visi --proxy-passwd secret --no-check-apikey
Updated synapse-alienvault config "myunscoped"

The username is stored in the configuration and the password is stored in the configuration secrets. The credentials are only valid with a proxy URL, and are removed if the proxy is later set to (true) or (false). The values must be URL safe, see $lib.inet.http.urlencode.

Permissions

Package (synapse-alienvault) defines the following permissions:
power-ups.alienvault.user        : Controls user access to Synapse-AlienVault. ( default: false )
power-ups.alienvault.admin       : Controls access to Synapse-AlienVault admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.alienvault.user
Added rule power-ups.alienvault.user to user visi.

or:

> auth.role.addrule ninjas power-ups.alienvault.user
Added rule power-ups.alienvault.user to role ninjas.

Exported APIs

Synapse-AlienVault does not currently export any APIs.

Node Actions

Synapse-AlienVault provides the following node actions in Optic:

Name : pDNS API
Desc : Enrich inet:fqdn, inet:ipv4, or inet:ipv6 nodes using the AlienVault pDNS API.
Forms: inet:fqdn, inet:ipv4, inet:ipv6

Name : domain API
Desc : Enrich inet:fqdn nodes using the AlienVault domain API.
Forms: inet:fqdn

Name : files API
Desc : Enrich file:bytes, hash:md5, hash:sha1, and hash:sha256 nodes using the AlienVault files API.
Forms: file:bytes, hash:sha256, hash:sha1, hash:md5

Name : url API
Desc : Enrich inet:url nodes using the AlienVault URL API.
Forms: inet:url

Name : ip API
Desc : Enrich inet:ipv4 and inet:ipv6 nodes using the AlienVault ip API.
Forms: inet:ipv4, inet:ipv6

Onload Events

Synapse-AlienVault does not use any onload events. It uses Storm package inits to run required data migrations.

The node migrations run in every view and require Synapse v2.255.0 or later. Views with a read-only write layer are skipped with a warning. Each migration runs once, and migrations already completed by earlier versions of the Power-Up are not run again.