Admin Guide

Synapse-Cybersixgill Admin Guide

Configuration

Synapse-Cybersixgill requires a Cybersixgill API key. For information on how to generate credentials, please visit the Cybersixgill developer portal.

Setting API key for global use

To set-up a global API key:

> cybersixgill.config.add default myclientid myclientsecret
Synapse-Cybersixgill config "default" added

The client id and secret are verified by requesting a Cybersixgill API token when a configuration is added, or when its client id or secret is updated, and the change is not saved if the request fails. Use --no-check-apikey to skip the verification.

Creating a configuration for role-based use

Add an unscoped configuration:

> cybersixgill.config.add myunscoped myclientid myclientsecret --scope unscoped
Synapse-Cybersixgill config "myunscoped" added

Grant another user admin permissions to the new configuration:

> cybersixgill.config.update myunscoped --perm user visi admin
Updated Synapse-Cybersixgill config "myunscoped"

Grant a role read permissions to the new configuration:

> cybersixgill.config.update myunscoped --perm role ninjas read
Updated Synapse-Cybersixgill config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-Cybersixgill commands.

Setting the tag prefix

The tag prefix used when recording Cybersixgill tags defaults to rep.cybersixgill. It may be set per configuration using the --tag-prefix option to cybersixgill.config.add or cybersixgill.config.update, or for all configurations using cybersixgill.config.migrate:

> cybersixgill.config.migrate --tag-prefix my.tagpref
Updated Synapse-Cybersixgill config "synapse-cybersixgill:myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.cybersixgill.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Dependencies

Synapse-Cybersixgill does not have any dependencies.

Permissions

Package (synapse-cybersixgill) defines the following permissions:
power-ups.cybersixgill.user      : Controls user access to Synapse-Cybersixgill. ( default: false )
power-ups.cybersixgill.admin     : Controls access to Synapse-Cybersixgill admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.cybersixgill.user
Added rule power-ups.cybersixgill.user to user visi.

or:

> auth.role.addrule ninjas power-ups.cybersixgill.user
Added rule power-ups.cybersixgill.user to role ninjas.

Exported APIs

Synapse-Cybersixgill does not currently export any APIs.

Workflows

Synapse-Cybersixgill provides the following workflows in Optic:

Title: Configuration
Title: Credentials Leaks
Title: Intel Items

The Configuration workflow may be used to manage Synapse-Cybersixgill configurations from Optic.

Node Actions

Synapse-Cybersixgill provides the following node actions in Optic:

Name : iocs
Desc : Search for IOCs using Synapse-Cybersixgill
Forms: inet:fqdn, inet:ipv4, inet:url, hash:sha256, hash:sha1, hash:md5, file:bytes

Name : cve.enrich
Desc : Enrich CVEs with additional data from Synapse-Cybersixgill
Forms: it:sec:cve, risk:vuln