topic Re: IOCs upload to Secure Endpoint in Endpoint Security

IOCs upload to Secure Endpoint

larry.siegelman — Thu, 24 Feb 2022 10:43:36 GMT

Hello,

I have hash values that I would like to upload to the Secure Endpoint platform.

Is there any logical publication showing how to do so?

I see that an XML file format is needed.

What are some samples, so it would match?

Re: IOCs upload to Secure Endpoint

Troja007 — Thu, 24 Feb 2022 15:49:41 GMT

Hello @larry.siegelman ,
the CloudIOC detections generated by backend engines are fully managed by Cisco. The customer cannot generate custom "Real Time IOC detections". You are able to do Endpoint IOC Scans. What do you want to do?
Greetings,
Thorsten

Re: IOCs upload to Secure Endpoint

johnosn — Fri, 25 Feb 2022 17:14:03 GMT

You can check the Cisco Endpoint IOC Attributes document available from the Secure Endpoint Documentation portal. The document contains links to several examples in OpenIOC format. There are several other resources available online from various vendors related to the OpenIOC format including those found at openioc.com.

Re: IOCs upload to Secure Endpoint

larry.siegelman — Sun, 27 Feb 2022 04:42:20 GMT

Hello,
Thank you for the information, but that is not what I am looking for.
I have experience with other security platforms from other leading vendors,
and to upload hash files from threat feeds or from our national CIRT, is
much easier.
Why does Cisco have to make you jump through hoops in order to upload
hashes?

Re: IOCs upload to Secure Endpoint

larry.siegelman — Sun, 27 Feb 2022 05:00:20 GMT

I have experience with other security platforms from other leading vendors,
and to upload hash files from threat feeds or from our national CIRT, is
much easier.
Why does Cisco have to make you jump through hoops in order to upload
hashes?

Re: IOCs upload to Secure Endpoint

Troja007 — Tue, 01 Mar 2022 07:18:12 GMT

Hello @larry.siegelman ,
I´m working on Feature Requests for Secure Endpoint. Just to be specific defining the Feature request.

When uploading hashes from Threat Feeds, what should be the action?

Generating an alert that the file has been seen?
Block the execution of the file?
Quarantine the file?

Thanks and Greetings,
Thorsten

Re: IOCs upload to Secure Endpoint

larry.siegelman — Tue, 01 Mar 2022 07:36:20 GMT

Hello @Troja007

If we can upload hashes, then I would expect that it would block the file
or executable from being able to propagate.
As with any other malware/IOC that gets blocked in our environment, these
too would be shown that their presence was blocked.
We already have Cisco threat Response to verify that it was not present.

Re: IOCs upload to Secure Endpoint

Ken Stieers — Tue, 01 Mar 2022 19:41:20 GMT

Hey Larry,
What format are the files you're trying to upload? Is it something standard?
Ken

Re: IOCs upload to Secure Endpoint

larry.siegelman — Wed, 02 Mar 2022 05:56:20 GMT

Hi Ken,

Yes, basically, hashes of recognized files.
I have experience with other globally leading vendors, where I was able to
upload, albeit to our direct environment, hash values.

Re: IOCs upload to Secure Endpoint

Ken Stieers — Wed, 02 Mar 2022 11:58:20 GMT

I meant csv, json, xml, stix, yara?

Re: IOCs upload to Secure Endpoint

larry.siegelman — Wed, 02 Mar 2022 12:06:20 GMT

Sorry, more than likely .csv format.
I would require the format of the table beforehand in order to upload
accordingly.

Re: IOCs upload to Secure Endpoint

Ken Stieers — Wed, 02 Mar 2022 15:04:15 GMT

I guess I'm confused as to what the issue is...

Outbreak Control/Custom detections, create or add to a current one... you can add SHAs there...

Re: IOCs upload to Secure Endpoint

larry.siegelman — Wed, 02 Mar 2022 15:21:20 GMT

You know what, it says "Simple" and I never took it to be that!
How silly do I feel now? 🙂
Having said that, is there a required format for the file?
Any examples to download and use as a template?

Re: IOCs upload to Secure Endpoint

Ken Stieers — Wed, 02 Mar 2022 16:32:20 GMT

One SHA per line for a set of SHA's, they all get the same note...
Hey Torsten, and ehn would be to be able to pull the note from the CSV... so the SHA's get their own note.