Package Documentation

Storm Package: synapse-intel471

The following Commands are available from this package. This documentation is generated for version 3.0.0 of the package.

Storm Commands

This package implements the following Storm Commands.

intel471.dataleak.post.search

Search for data leak blog posts matching filter criteria.

At least one of --post, --postsbythreaduid, or --blog must be specified
to perform the search.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

Note:

  Intel471 queries return a maximum of 1100 items.

Examples:

  // Search by blog and filter using a time range
  intel471.dataleak.post.search --blog "Blackout RaaS operator(s)" --from "-30days"

  // Free text search for data leak posts and do not download file listing archives
  intel471.dataleak.post.search --post financial --skip-attachments

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.dataleak.search`` command instead.


Deprecated: "intel471.dataleak.post.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.dataleak.post.search [options]

Options:

  --help                      : Display the command usage.
  --post <post>               : Search text in data leak posts and topics.
  --postsbythreaduid <postsbythreaduid>: Search data leak posts by thread uid.
  --blog <blog>               : Search data leak posts in a given data leak blog.
  --from <from>               : Search for data leak posts created after a specified time.
  --until <until>             : Search for data leak posts created before a specified time.
  --lastupdatedfrom <lastupdatedfrom>: Search for data leak posts updated after a specified time.
  --lastupdateduntil <lastupdateduntil>: Search for data leak posts updated before a specified time.
  --sort <sort>               : Specify sort order. (default: relevance, choices: relevance, earliest, latest)
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.
  --skip-attachments          : Skip downloading file listing archives included in results (if present).

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.forum.post.search

Search for forum posts matching filter criteria.

At least one of --post, --postsbythreaduid, or --forum must be specified
to perform the search.

This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.

Note:

  Intel471 queries return a maximum of 1100 items.

Examples:

  // Search text in posts and topics
  intel471.forum.post.search --post hacked

  // Search by forum and filter using a time range
  intel471.forum.post.search --forum opensc.ws --from "-30days"

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.forum.search --type post`` command instead.


Deprecated: "intel471.forum.post.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.forum.post.search [options]

Options:

  --help                      : Display the command usage.
  --post <post>               : Search text in posts and topics.
  --postsbythreaduid <postsbythreaduid>: Search posts by thread uid.
  --actor <actor>             : Search posts authored by given actor handle.
  --forum <forum>             : Search posts in a given forum.
  --from <from>               : Search for posts created after a specified time.
  --until <until>             : Search for posts created before a specified time.
  --lastupdatedfrom <lastupdatedfrom>: Search for posts updated after a specified time.
  --lastupdateduntil <lastupdateduntil>: Search for posts updated before a specified time.
  --sort <sort>               : Specify sort order (relevance, earliest, or latest).
  --debug                     : Show verbose debug output.
  --size <size>               : Limit the number of results ingested to the given size.
  --yield                     : Yield the newly created nodes.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.girs.sync

Download and populate Intel471 GIR definitions.

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.girs.sync`` command instead.

Examples:

  // Download and populate the GIR definitions.
  intel471.girs.sync


Deprecated: "intel471.girs.sync" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.girs.sync [options]

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.inforeport.get

Retrieve an information or fintel report by UID.

This command takes an information or fintel report UID as input and queries the Intel471
API to retrieve the report. An incomplete media:news node created by other Intel471
commands may also be used as input to populate the full report details.

Examples:

  // Retrieve a report by UID
  intel471.inforeport.get ce1c92f84040f1ad008b55665bfde326

  // Use media:news nodes to retrieve reports
  media:news:publisher:name=intel471 | intel471.inforeport.get

  // Retrieve a report by UID and do not download attachments
  intel471.inforeport.get ce1c92f84040f1ad008b55665bfde326 --skip-attachments

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.inforeport.get`` command instead.


Deprecated: "intel471.inforeport.get" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.inforeport.get [options] <uid>

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.
  --skip-attachments          : Skip downloading files attached to reports.

Arguments:

  [uid]                       : The report identifier to retrieve.

Inputs:

  media:news                  : media:news nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.setup.apikey

Manage the Intel471 user email and API key.

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.config.add`` command to configure credentials.

Examples

    // Configure global Intel471 credentials
    intel471.setup.apikey test@gmail.com abcd1234

    // Configure Intel471 credentials for the current user
    intel471.setup.apikey --self test@gmail.com abcd1234

    // Display the scope of the current credentials
    intel471.setup.apikey --show-scope

    // Display the current credentials.
    intel471.setup.apikey --show-apikey

    // Remove the current global credentials.
    intel471.setup.apikey --remove

    // Remove the per-user credentials for the current user.
    intel471.setup.apikey --self --remove


Deprecated: "intel471.setup.apikey" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.setup.apikey [options] <email> <apikey>

Options:

  --help                      : Display the command usage.
  --self                      : Set or remove the credentials as a user variable. If not used, set them globally.
  --show-scope                : Display the credentials scope in use (global vs self).
  --show-apikey               : Display the credentials (requires admin perms or a "self" scope key).
  --remove                    : Remove the configured credentials. May be used with --self.

Arguments:

  [email]                     : Email address for authentication.
  [apikey]                    : The API key string.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.setup.tagprefix

Set the tag prefix used when recording Intel471 data as tags.
The default tag prefix is "rep.intel471" if not specified.
Any tags provided by the Intel471 API will be added within the given namespace.
For example, the item "foo" would result in "#rep.intel471.foo".  Any
characters incompatible with tag names are replaced with "_".

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.config.add``/``.update`` commands to set a tag prefix.


Deprecated: "intel471.setup.tagprefix" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.setup.tagprefix [options] <tagname>

Options:

  --help                      : Display the command usage.

Arguments:

  <tagname>                   : The tag prefix to use.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.config.add

Add a Synapse-Intel471 Verity configuration.

Examples:

  // Add a global configuration
  intel471.verity.config.add global_config myclientid myclientsecret

  // Add a configuration for the current user
  intel471.verity.config.add --scope self my_config myclientid myclientsecret


Usage: intel471.verity.config.add [options] <name> <client-id> <client-secret>

Options:

  --help                      : Display the command usage.
  --tag-prefix <tag_prefix>   : The tag prefix to use when recording data from Intel471 Verity. (default: rep.intel471)
  --scope <scope>             : Set the scope on the configuration. (default: global, choices: global, self, unscoped)

Arguments:

  <name>                      : A unique name for the configuration.
  <client_id>                 : The Intel471 Verity Client ID string.
  <client_secret>             : The Intel471 Verity Client Secret string.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.config.del

Delete a Synapse-Intel471 Verity configuration.

Examples:

  // Delete the "fooconfig" configuration
  intel471.verity.config.del fooconfig


Usage: intel471.verity.config.del [options] <name>

Options:

  --help                      : Display the command usage.

Arguments:

  <name>                      : The name of the configuration.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.config.list

Display the list of Synapse-Intel471 Verity configurations you have access to.


Usage: intel471.verity.config.list [options]

Options:

  --help                      : Display the command usage.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.config.show

Show the details of a Synapse-Intel471 Verity configuration.

Examples:

  // Show the in-use configuration for the current user
  intel471.verity.config.show

  // Show a configuration by name
  intel471.verity.config.show myconfig


Usage: intel471.verity.config.show [options] <name>

Options:

  --help                      : Display the command usage.

Arguments:

  [name]                      : The name of the configuration.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.config.update

Update the configuration of a defined Synapse-Intel471 Verity configuration.

Examples:

  // Set the permission level for user "myuser" to "admin" on the "fooconfig"
  // configuration
  intel471.verity.config.update fooconfig --perm user myuser admin

  // Set the permission level for the "all" role to "deny" on the
  // "fooconfig" configuration
  intel471.verity.config.update fooconfig --perm role all deny

  // Change the name of the "fooconfig" configuration to "barconfig"
  intel471.verity.config.update fooconfig --name barconfig


Usage: intel471.verity.config.update [options] <config>

Options:

  --help                      : Display the command usage.
  --client-id <client_id>     : The Intel471 Verity Client ID string. (default: None)
  --client-secret <client_secret>: The Intel471 Verity Client Secret string. (default: None)
  --tag-prefix <tag_prefix>   : The tag prefix to use when recording data from Intel471 Verity. (default: None)
  --perm <perm>               : Set the permission level for a user or role on this configuration.
                                Arguments to this option are ``scope``, ``name``, ``level``:
                                  <scope>: The scope for the permission, either "user" or "role".
                                  <name>: The user/role name depending on scope.
                                  <level>: The $lib.auth.easyperm.level, or None to remove the permission.
                                 (default: None)
  --name <name>               : Rename the configuration. (default: None)

Arguments:

  <config>                    : The name of the configuration to modify.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.girs.sync

Download and populate Intel471 Verity GIR definitions.

Examples:

  // Download and populate the GIR definitions.
  intel471.verity.girs.sync


Usage: intel471.verity.girs.sync [options]

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.inforeport.get

Retrieve an Intel471 Verity report by UID.

This command takes a report UID as input and tries each of the typed
report endpoints (info, fintel, malware, spot, breach-alert,
vulnerability) in turn until the report is found. An incomplete
media:news node created by other Intel471 Verity commands may also be
used as input to populate the full report details.

Examples:

  // Retrieve a report by UID
  intel471.verity.inforeport.get vulnerability--527c3004-241f-599d-9dbd-00ac1d6d52f6

  // Use media:news nodes to retrieve reports
  media:news:publisher:name=intel471 | intel471.verity.inforeport.get


Usage: intel471.verity.inforeport.get [options] <uid>

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Arguments:

  [uid]                       : The report identifier to retrieve.

Inputs:

  media:news                  : media:news nodes

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.verity.vulns.get

Retrieve an Intel471 Verity vulnerability report by UID.

Examples:

  // Retrieve a report by UID
  intel471.verity.vulns.get vulnerability--527c3004-241f-599d-9dbd-00ac1d6d52f6


Usage: intel471.verity.vulns.get [options] <uid>

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.
  --config <config>           : Override the default config with the provided name.

Arguments:

  [uid]                       : The vulnerability report identifier to retrieve.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

intel471.vulns.get

Retrieve a vulnerability report by UID.

This command takes a vulnerability report UID as input and queries the Intel471
API to retrieve the report.

Examples:

  // Retrieve a report by UID
  intel471.vulns.get ce1c92f84040f1ad008b55665bfde326

  // Use risk:vuln nodes to retrieve reports
  risk:vuln:_intel471:uid | intel471.vulns.get :_intel471:uid

NOTE: This is an Intel471 Titan API command. Verity users should use the
  ``intel471.verity.vulns.get`` command instead.


Deprecated: "intel471.vulns.get" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

Usage: intel471.vulns.get [options] <uid>

Options:

  --help                      : Display the command usage.
  --debug                     : Show verbose debug output.
  --yield                     : Yield the newly created nodes.

Arguments:

  [uid]                       : The vulnerability report identifier to retrieve.

The command is accessible to users with one or more of the following permissions:

  • power-ups.intel471.admin

  • power-ups.intel471.user

Storm Modules

This package does not export any Storm APIs.