Package Documentation
Storm Package: synapse-cybersixgill
The following Commands are available from this package. This documentation is generated for version 2.0.1 of the package.
Storm Commands
This package implements the following Storm Commands.
cybersixgill.config.add
Add a Synapse-Cybersixgill configuration.
The client id and secret are verified by requesting a Cybersixgill API
token, and the configuration is not saved if the request fails. Use
--no-check-apikey to skip the verification.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
cybersixgill.config.add default myclientid myclientsecret
// Add a configuration for the current user
cybersixgill.config.add --scope self myconfig myclientid myclientsecret
Usage: cybersixgill.config.add [options] <name> <clientid> <secret>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording Cybersixgill tags. (default: rep.cybersixgill)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
--no-check-apikey : Do not verify the client id and secret by requesting a Cybersixgill API token.
Arguments:
<name> : A unique name for the configuration.
<clientid> : The Cybersixgill client id string.
<secret> : The Cybersixgill client secret string.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.config.del
Delete a Synapse-Cybersixgill configuration.
Examples:
// Delete the "myconfig" configuration
cybersixgill.config.del myconfig
Usage: cybersixgill.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.config.list
Display the list of Synapse-Cybersixgill configurations you have access to.
Usage: cybersixgill.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.config.migrate
Migrate options for all Synapse-Cybersixgill configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Disable SSL verification for all configurations
cybersixgill.config.migrate --ssl-verify (false)
// Migrate the tag prefix for all configurations
cybersixgill.config.migrate --tag-prefix my.tagpref
Usage: cybersixgill.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording Cybersixgill tags. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.admin
cybersixgill.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
cybersixgill.config.show
// Show a configuration by name
cybersixgill.config.show myconfig
Usage: cybersixgill.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.config.update
Update the configuration of a defined Synapse-Cybersixgill configuration.
A new client id or secret is verified by requesting a Cybersixgill API
token, and the configuration is not updated if the request fails. Use
--no-check-apikey to skip the verification.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
cybersixgill.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
cybersixgill.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
cybersixgill.config.update myconfig --ssl-verify (false)
// Change the tag prefix used by the "myconfig" configuration
cybersixgill.config.update myconfig --tag-prefix my.prefix
// Change the name of the "myconfig" configuration to "otherconfig"
cybersixgill.config.update myconfig --name otherconfig
Usage: cybersixgill.config.update [options] <config>
Options:
--help : Display the command usage.
--clientid <clientid> : The Cybersixgill client id string. (default: None)
--secret <secret> : The Cybersixgill client secret string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording Cybersixgill tags. (default: None)
--name <name> : Rename the configuration. (default: None)
--no-check-apikey : Do not verify the client id and secret by requesting a Cybersixgill API token.
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.credentials.leaks
Query the Cybersixgill Credentials Leaks API.
This command takes inet:fqdn or inet:email nodes as input and queries the Credentials Leaks
API to retrieve leaked credential information by domain or email address.
Examples:
// Query credential leaks by domain
inet:fqdn=vertex.link | cybersixgill.credentials.leaks
// Query credential leaks by email address
inet:email=blackout@vertex.link | cybersixgill.credentials.leaks
Usage: cybersixgill.credentials.leaks [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--start <start> : Specify the start date/time to search from. (default: -30days)
--end <end> : Specify the end date/time to search to. (default: now)
--config <config> : Override the default config with the provided name.
Inputs:
inet:email : inet:email nodes
inet:fqdn : inet:fqdn nodes
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.cve.enrich
Query the DVE Enrichment API for information on CVEs.
This command takes it:sec:cve or risk:vuln nodes as input and queries the
DVE Enrichment API to retrieve additional CVE information. If a risk:vuln is provided
and :reporter:name!=cybersixgill a new risk:vuln node will be created.
You may also query by providing a CVE identifier to the --cve argument.
Examples:
// Enrich an it:sec:cve node
it:sec:cve=CVE-2020-0796 | cybersixgill.cve.enrich --yield
// Specify a CVE with --cve
cybersixgill.cve.enrich --cve CVE-2020-0796 --yield
Usage: cybersixgill.cve.enrich [options]
Options:
--help : Display the command usage.
--cve <cve> : Specify a CVE to get data for.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
it:sec:cve : it:sec:cve nodes
risk:vuln : risk:vuln nodes
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.intel.items
Query the Cybersixgill Intel Items API.
Note: The default time range is the last seven days (start: -7days to end:
now). These values were selected to maximize the chance of a successful
response from the API. If selecting a larger time range, especially with a
broad query, be aware of possible failures due to API timeouts.
This command will also create an it:exec:query node to represent the query options,
and will link resulting nodes to it via -(found)> edges.
Examples:
// Query for qakbot, limit to 100 nodes, and yield the results
cybersixgill.intel.items qakbot --size 100 --yield
// Query for qakbot but only repository typed items, in the last 10 days
cybersixgill.intel.items "qakbot AND type:repository" --start "-10days"
Usage: cybersixgill.intel.items [options] <query>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--start <start> : Specify the start date/time to search from. (default: -7days)
--end <end> : Specify the end date/time to search to. (default: now)
--config <config> : Override the default config with the provided name.
Arguments:
<query> : The search query.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.intel.items.byid
Query the Cybersixgill Intel Items API by item ID.
Examples:
// Query for an intel item by ID
cybersixgill.intel.items.byid aWxtLWltLTAwMDQzN185YWZmM2QyMzJlMzE3ZmY4ZmEzMTA1ZWNlZTVmMzg1ZGNiNmQzYTIz
Usage: cybersixgill.intel.items.byid [options] <id>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
Arguments:
<id> : The item ID to query.
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
cybersixgill.iocs
Query the Dark Feed Enrichment API for information on IOCs.
This command takes inet:fqdn, inet:ipv4, inet:url, hash:md5, hash:sha1, hash:sha256,
or file:bytes nodes as input and queries the the Dark Feed Enrichment API to retrieve
additional IOC information.
You may also search for IOCs based on actor names and sixgill post IDs by specifying
--field <name>=<value> where "name" is either "actor" or "post_id", and value is
the value to search for.
This command will also create an it:exec:query node to represent the query syntax and
link resulting IOC nodes to it via -(found)> edges. If an inbound node is used to
search, a -(refs)> edge will also be added from the query node to the inbound node.
Note: Channel ID d5cd46c205c20c87006b55a18b106428 is used when querying the API.
Examples:
// Enrich an md5 hash
hash:md5=ad49374e3c72613023fe420f0d6010d9 | cybersixgill.iocs --yield
// Search for IOCs by actor name
cybersixgill.iocs --yield --field actor=james
Usage: cybersixgill.iocs [options]
Options:
--help : Display the command usage.
--field <field> : Search for a sixgill field in <name>=<value> format, where "name" is "actor" or
"post_id".
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : file:bytes nodes
hash:md5 : hash:md5 nodes
hash:sha1 : hash:sha1 nodes
hash:sha256 : hash:sha256 nodes
inet:fqdn : inet:fqdn nodes
inet:ipv4 : inet:ipv4 nodes
inet:url : inet:url nodes
The command is accessible to users with one or more of the following permissions:
power-ups.cybersixgill.adminpower-ups.cybersixgill.user
Storm Modules
This package does not export any Storm APIs.