Skip to content

Home

Jump to bottom
Koji Yamada edited this page May 16, 2019 · 17 revisions

Seamless Threat Intelligence Platform (S-TIP)

Seamless Threat Intelligence Platform enables better incident response and information sharing, which brings down barriers among separate practices of CTI sharing.

S-TIP is built around a very simple, but extremely powerful concept - Convert whatever CTI into a STIX file or a set of STIX files, send them around, and create different views dynamically from those STIX file.

STIX/TAXII Support

  • STIX 1.1/1.2/2.0
  • TAXII 1.1 Client/Server

TAXII 2.0 compatibility is coming soon.

S-TIP Architecture

S-TIP consists of three modules.

  1. RS
  2. SNS
  3. GV

S-TIP Architecture

1. RS (Repository System)

RS is the store and transport hub of STIX files. It uses MongoDB to store STIX 1.x and STIX 2.x data. RS serves as a TAXII client. RS as a TAXII client can connect to TAXII servers to download STIX files. (RS also serves as TAXII server with using opentaxii.)

RS List view

Adapter for CTI sources / 3rd party tools

  • AlienVault OTX
  • MISP
  • iSIGHTPartners

2. SNS (Social Networking Service)

SNS is a practical interface of social media for users. It uses bootcamp internally.

screenshot

Important to note is that there are both human CTI and System CTI in the same timeline.

User creates a new post with Title/Content/Attachment files(e.g. csv of indicators)/TLP/Sharing Range. The post is automatically converted to a STIX file and accumulated into RS.

CTI Element Extractor

　S-TIP tries to extract IoCs and other elements like CVEs from the post and its attachments. Currently, it extracts

  • Domain names
  • Email addresses
  • File names
  • IPv4 addresses
  • MD5/SHA1/SHA256/SHA512/ hash values
  • URLs

TLP

　The TLP (Red/Amber/Green/White) is saved into the STIX.

Sharing Range

　Sharing Range is not saved in STIX. This is for sharing with other users in the S-TIP instance.

Third Party Tool Integration

  • JIRA

3. GV (Graph View)

GV is a CTI Graph Analytics View.

It visualizes STIX as CTI connected graph. Nodes are STIX elements like Indicators/Observables/Threat Actors/TTPs/Exploit Targets/Course of Actions/Campaigns.

When the user select a specific STIX, S-TIP automatically searches related STIX stored in RS and lists them. Related STIXs are linked to each other through thick links. (In the below diagram, Each STIX has the same IPv4 address as indicator).

GV

Future Work

  • Migration to Python 3.x
  • Slack integration
  • TAXII 2.x support
Clone this wiki locally