Admin Guide

Synapse-PassiveTotal Admin Guide

Configuration

Synapse-PassiveTotal requires you to have a PassiveTotal API key. For more information on how to signup, please visit the PassiveTotal API documentation.

Setting API key for global use

To set-up a global API key:

> passivetotal.config.add default myapiuser myapikey
Synapse-PassiveTotal config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> passivetotal.config.add myunscoped myapiuser myapikey --scope unscoped
Synapse-PassiveTotal config "myunscoped" added

Grant another user admin permissions to the new configuration:

> passivetotal.config.update myunscoped --perm user visi admin
Updated Synapse-PassiveTotal config "myunscoped"

Grant a role read permissions to the new configuration:

> passivetotal.config.update myunscoped --perm role ninjas read
Updated Synapse-PassiveTotal config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-PassiveTotal commands.

Setting the tag prefix

The tag prefix used when recording data from PassiveTotal defaults to rep.pt. It may be set per configuration using the --tag-prefix option to passivetotal.config.add or passivetotal.config.update, or for all configurations using passivetotal.config.migrate:

> passivetotal.config.migrate --tag-prefix my.tagpref
Updated Synapse-PassiveTotal config "synapse-passivetotal:default"
Updated Synapse-PassiveTotal config "synapse-passivetotal:myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.passivetotal.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Permissions

Package (synapse-passivetotal) defines the following permissions:
power-ups.passivetotal.user      : Allows a user to issue queries to the PassiveTotal API. ( default: false )
power-ups.passivetotal.admin     : Controls access to Synapse-PassiveTotal admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.passivetotal.user
Added rule power-ups.passivetotal.user to user visi.

or:

> auth.role.addrule ninjas power-ups.passivetotal.user
Added rule power-ups.passivetotal.user to role ninjas.

Exported APIs

Synapse-PassiveTotal does not currently export any APIs.

Node Actions

Synapse-PassiveTotal provides the following node actions in Optic:

Name : pdns
Desc : Get passive DNS information from PassiveTotal
Forms: inet:ipv4, inet:fqdn

Name : malware
Desc : Get malware data from PassiveTotal
Forms: inet:fqdn, inet:ipv4, inet:ipv6

Name : osint
Desc : Get OSINT data from PassiveTotal
Forms: inet:fqdn, inet:ipv4, inet:ipv6

Name : enrich
Desc : Get enrichment data from PassiveTotal
Forms: inet:fqdn, inet:ipv4, inet:ipv6

Name : subdomains
Desc : Get subdomains from PassiveTotal
Forms: inet:fqdn

Name : trackers
Desc : Get tracker data from PassiveTotal
Forms: inet:fqdn, inet:ipv4, inet:ipv6

Name : ssl.get
Desc : Get an SSL certificate from PassiveTotal
Forms: hash:sha1

Name : ssl.history
Desc : Get SSL certificate history from PassiveTotal
Forms: inet:ipv4, inet:server, file:bytes, inet:tls:servercert, crypto:x509:cert, hash:sha1

Name : whois
Desc : Get WHOIS information from PassiveTotal
Forms: inet:fqdn

Name : whois history
Desc : Get historical WHOIS information from PassiveTotal
Forms: inet:fqdn

Workflows

Synapse-PassiveTotal provides a Configuration workflow in Optic, which may be used to manage Synapse-PassiveTotal configurations.