Package Documentation
Storm Package: synapse-alienvault
The following Commands are available from this package. This documentation is generated for version 3.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
alienvault.config.add
Add a Synapse-AlienVault configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Add a global configuration
alienvault.config.add global_config apikey1234
// Add a configuration for the current user
alienvault.config.add --scope self my_config apikey5678
Usage: alienvault.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from AlienVault. (default: rep.alienvault)
--scope <scope> : Set the scope on the configuration. A "self" config belongs to the user
who created it, and is stored and listed with the scope "user".
(default: global, choices: global, self, unscoped)
--no-check-apikey : Do not perform API key validation with AlienVault.
Arguments:
<name> : A unique name for the configuration.
<apikey> : The API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.config.del
Delete a Synapse-AlienVault configuration.
Examples:
// Delete the "fooconfig" configuration
alienvault.config.del fooconfig
Usage: alienvault.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.config.list
Display the list of Synapse-AlienVault configurations you have access to.
Usage: alienvault.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.config.migrate
Update options for every Synapse-AlienVault configuration at once.
Requires admin permission on the Synapse-AlienVault power-up.
API key validation is skipped when running this command.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Migrate the tag prefix for all configurations
alienvault.config.migrate --tag-prefix my.tagpref
Usage: alienvault.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from AlienVault. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.admin
alienvault.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
alienvault.config.show
// Show a configuration by name
alienvault.config.show myconfig
Usage: alienvault.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.config.update
Update the configuration of a defined Synapse-AlienVault configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Set the permission level for user "myuser" to "admin" on the "fooconfig"
// configuration
alienvault.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
alienvault.config.update fooconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "fooconfig"
alienvault.config.update fooconfig --ssl-verify (false)
// Change the name of the "fooconfig" configuration to "barconfig"
alienvault.config.update fooconfig --name barconfig
Usage: alienvault.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are `scope`, `name`, `level`:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from AlienVault. (default: None)
--name <name> : Rename the configuration. (default: None)
--no-check-apikey : Do not perform API key validation with AlienVault.
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.domain
Enrich a URL or domain using the OTX API.
Examples:
// Retrieve info about a FQDN, yielding out the nodes created
inet:fqdn=vertex.link | alienvault.otx.domain --yield
Usage: alienvault.otx.domain [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.files
Enrich a file or hash using the OTX API.
Examples:
// Retrieve info about a file, yielding out nodes created
file:bytes | alienvault.otx.files --yield
Usage: alienvault.otx.files [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--asof <asof> : This argument is deprecated and no longer has any effect.
Inputs:
file:bytes : A file:bytes node with a compatible hash property to enrich
hash:md5 : An MD5 hash to enrich
hash:sha1 : A SHA1 hash to enrich
hash:sha256 : A SHA256 hash to enrich
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.ip
Enrich an IP address using the OTX API.
Examples:
// Retrieve info about an ipv4 address, yielding out the nodes created
inet:ipv4=8.8.8.8 | alienvault.otx.ip --yield
// Retrieve info about all ipv6 addresses
inet:ipv6 | alienvault.otx.ip --yield
Usage: alienvault.otx.ip [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.pdns
Lookup Passive DNS records for inbound inet:fqdn, inet:ipv4, or inet:ipv6 nodes.
Examples:
// Query a specific fqdn
inet:fqdn=vertex.link | alienvault.otx.pdns
// Query an IP address
inet:ipv4=1.2.3.4 | alienvault.otx.pdns
Usage: alienvault.otx.pdns [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--asof <asof> : This argument is deprecated and no longer has any effect.
Inputs:
inet:fqdn : Query Passive DNS records for FQDNs
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.pulses
Retrieve AlienVault OTX Pulses subscribed to by the API key user.
Examples:
// Retrieve the latest pulses
alienvault.otx.pulses
// Retrieve the latest pulses, and yield up to 2 of the created nodes
alienvault.otx.pulses --yield --size 2
// Re-download the entire list of pulses.
alienvault.otx.pulses --resync --yield
Usage: alienvault.otx.pulses [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--resync : Redownload the entire list of subscribed pulses, starting from the beginning of time.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.pulses.byid
Retrieve specific AlienVault OTX Pulses by ID.
Examples:
// Download and ingest AlienVault Pulse ID 61090c601d7bda90aed534df
alienvault.otx.pulses.byid 61090c601d7bda90aed534df
Usage: alienvault.otx.pulses.byid [options] <pulseids>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
Arguments:
<pulseids> [<pulseids> ...] : The pulse IDs
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
alienvault.otx.url
Enrich a URL using the OTX API.
Examples:
// Retrieve info about a URL, yielding out nodes created
inet:url=https://images.google.com | alienvault.otx.url --yield
Usage: alienvault.otx.url [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.alienvault.adminpower-ups.alienvault.user
Storm Modules
This package does not export any Storm APIs.