Admin Guide

Synapse-Doppel Admin Guide

Configuration

Synapse-Doppel uses the Doppel v2 API, which requires a Client ID and Client Secret. Client credentials can be created in Doppel Vision under API Settings on the Version 2 tab. A Client Secret is only shown once when the client is created. Doppel v1 API keys and user API keys cannot be used.

For more information, please visit the Doppel API documentation.

Synapse-Doppel exchanges the Client ID and Client Secret for an access token, which is cached in the configuration and replaced automatically once it expires. Changing the Client ID or Client Secret of a configuration discards the cached token. Doppel’s token endpoint limited each client to 5 token requests per hour in testing (this limit is not in the Doppel documentation), so avoid sharing a Client ID across many configurations or repeatedly updating credentials. The audience requested for the token defaults to doppel-external and can be changed with the --audience option of doppel.config.add and doppel.config.update.

The doppel-config workflow in Optic has an Audience field and only checks that the Client ID and Client Secret are set. It does not validate them with Doppel, so the first query makes the token request.

Setting the configuration for global use

To set-up a global configuration:

> doppel.config.add global_config global_clientid global_clientsecret
Synapse-Doppel config "global_config" added

Creating a configuration for role-based use

Add an unscoped configuration:

> doppel.config.add myunscoped myclientid myclientsecret --scope unscoped
Synapse-Doppel config "myunscoped" added

Grant another user admin permissions to the new configuration:

> doppel.config.update myunscoped --perm user visi admin
Updated Synapse-Doppel config "myunscoped"

Grant a role read permissions to the new configuration:

> doppel.config.update myunscoped --perm role ninjas read
Updated Synapse-Doppel config "myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.doppel.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Dependencies

Synapse-Doppel does not have any dependencies.

Permissions

Package (synapse-doppel) defines the following permissions:
power-ups.doppel.user            : Controls user access to Synapse-Doppel. ( default: false )
power-ups.doppel.admin           : Controls access to Synapse-Doppel admin options. ( default: false )

You may add rules to users/roles directly from Storm:

> auth.user.addrule visi power-ups.doppel.user
Added rule power-ups.doppel.user to user visi.

or:

> auth.role.addrule ninjas power-ups.doppel.user
Added rule power-ups.doppel.user to role ninjas.

Workflows

Synapse-Doppel provides the following workflows in Optic:

Title: Configuration

Node Actions

Synapse-Doppel provides the following node actions in Optic:

Name : alert.get
Desc : Get/update the specified alert using Synapse-Doppel
Forms: risk:alert, inet:url, tel:phone

Name : alerts
Desc : Get alerts for the URL or domain using Synapse-Doppel
Forms: inet:url, inet:fqdn