This tool investigate anomalies on Carbon Black EDR using RiskIQ PassiveTotal public IoCs.
- Install Python 3 and PIP
- Clone this repository
- Go inside the repository and install the requirements:
pip install -r requirements.txt- Login https://community.riskiq.com and obtain api key.
- Finally, build the config file using the api key. (Please check out PassiveTotal guide: https://passivetotal.readthedocs.io/en/latest/getting-started.html#install-the-passivetotal-library)
First, it connects to the PassiveTotal service and pulls up to date threat reports. It processes the public IoCs found in the docs and translates it into a Carbon Black query. Finally, it searches for IoCs on the EDR and presents the results to the user in "csv" format.
- Url, port, and Carbon Black API Key fields must be entered in the config file.
- Config file and script must be in the same directory. Then the script can be run as follows:
python3 cb-passivetotal-connector.py- After the script runs, it will generate the results as ".csv" in the directory where it is located.
[APIKEY] API_KEY = apikey [URL] CB_URL = https://1.1.1.1 CB_PORT = 80