Vectra UDI connector

stix_shifter_modules/vectra/configuration/config.json

@@ -0,0 +1,30 @@
+{
+    "connection": {
+        "type": {
+            "displayName": "Vectra",
+            "group": "vectra"
+        },
+        "host": {
+            "type": "text",
+            "regex": "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$"
+        },
+        "help": {
+            "type": "link",
+            "default": "data-sources.html"
+        },
+        "options": {
+            "type": "fields",
+            "result_limit": {
+                "max": 10000
+            }
+        }
+    },
+    "configuration": {
+        "auth": {
+            "type" : "fields",
+            "api_token": {
+                "type": "password"
+            }
+        }
+    }
+}

stix_shifter_modules/vectra/configuration/lang_en.json

@@ -0,0 +1,19 @@
+{
+    "connection": {
+        "host": {
+            "label": "Management IP address or Hostname",
+            "description": "Specify the IP address or hostname of the data source"
+        },
+        "help": {
+            "label": "Need additional help?",
+            "description": "More details on the data source setting can be found in the specified link"
+        }
+    },
+    "configuration": {
+        "auth": {
+            "api_token": {
+                "type": "password"
+            }
+        }
+    }
+}

stix_shifter_modules/vectra/entry_point.py

@@ -0,0 +1,12 @@
+from stix_shifter_utils.utils.base_entry_point import BaseEntryPoint
+
+class EntryPoint(BaseEntryPoint):
+
+    # python main.py translate vectra query '{}' "[ipv4-addr:value = '127.0.0.1']"
+
+    def __init__(self, connection={}, configuration={}, options={}):
+        super().__init__(connection, configuration, options)
+        self.set_async(False)
+        if connection:
+            self.setup_transmission_basic(connection, configuration)
+        self.setup_translation_simple(dialect_default='default')

stix_shifter_modules/vectra/requirements.txt

@@ -0,0 +1 @@
+pyparsing==3.0.9

stix_shifter_modules/vectra/stix_translation/json/config_map.json

@@ -0,0 +1,84 @@
+{
+	"int_supported_fields": [
+		"detection.grouped_details.connection_events.dst_port",
+		"detection.grouped_details.num_events",
+		"detection.certainty",
+		"detection.grouped_details.events.target_summary.dst_port",
+		"detection.grouped_details.count",
+		"detection.grouped_details.sessions.bytes_sent",
+		"detection.grouped_details.events.count",
+		"detection.id",
+		"detection.grouped_details.events.dst_ports",
+		"detection.grouped_details.events.sessions.dst_port",
+		"detection.grouped_details.duration",
+		"detection.grouped_details.num_response_objects",
+		"detection.grouped_details.dst_ports",
+		"detection.grouped_details.events.num_response_objects",
+		"detection.grouped_details.connection_events.total_bytes_sent",
+		"detection.grouped_details.src_account.privilege_level",
+		"detection.grouped_details.anomalous_profiles.count",
+		"detection.grouped_details.events.bytes_sent",
+		"detection.grouped_details.src_host.privilege_level",
+		"detection.grouped_details.connection_events.total_bytes_rcvd",
+		"detection.grouped_details.num_services_high_privilege",
+		"detection.grouped_details.bytes_received",
+		"detection.grouped_details.targets.events.bytes_received",
+		"detection.grouped_details.events.sessions.duration",
+		"detection.grouped_details.dst_hosts.dst_port",
+		"detection.grouped_details.num_attempts",
+		"detection.grouped_details.num_services_requested",
+		"detection.grouped_details.bytes_sent",
+		"detection.grouped_details.events.bytes_received",
+		"detection.grouped_details.num_sessions",
+		"detection.grouped_details.sessions.dst_port",
+		"detection.grouped_details.service_accessed.privilege_level",
+		"detection.grouped_details.events.duration",
+		"detection.grouped_details.num_accounts",
+		"detection.grouped_details.origin_port",
+		"detection.grouped_details.sessions.bytes_received",
+		"detection.grouped_details.dst_geo_lat",
+		"detection.grouped_details.origin_geo_lat",
+		"detection.grouped_details.dst_geo_lon",
+		"detection.grouped_details.origin_geo_lon",
+		"detection.threat",
+		"detection.summary.num_sessions",
+		"detection.summary.num_attempts",
+		"detection.summary.num_successes",
+		"detection.summary.dst_ports",
+		"detection.summary.matches",
+		"detection.src_host.id",
+		"detection.src_host.threat",
+		"detection.src_host.certainty",
+		"detection.grouped_details.connection_events.duration_int"
+	],
+	"timestamp_supported_fields": [
+		"detection.first_timestamp",
+		"detection.grouped_details.first_timestamp",
+		"detection.grouped_details.sessions.first_timestamp",
+		"detection.grouped_details.events.first_timestamp",
+		"detection.grouped_details.events.sessions.first_timestamp",
+		"detection.grouped_details.events.target_summary.first_timestamp",
+		"detection.grouped_details.connection_events.first_timestamp",
+		"detection.last_timestamp",
+		"detection.grouped_details.last_timestamp",
+		"detection.grouped_details.dst_hosts.last_timestamp",
+		"detection.grouped_details.sessions.last_timestamp",
+		"detection.grouped_details.events.last_seen",
+		"detection.grouped_details.events.last_timestamp",
+		"detection.grouped_details.events.target_summary.last_timestamp",
+		"detection.grouped_details.connection_events.last_timestamp",
+		"detection.created_timestamp",
+		"detection.assigned_date",
+		"detection.grouped_details.first_seen",
+		"detection.grouped_details.last_seen",
+		"detection.grouped_details.targets.events.last_seen",
+		"detection.grouped_details.anomalous_profiles.first_timestamp",
+		"detection.grouped_details.anomalous_profiles.last_timestamp"
+	],
+	"boolean_supported_fields": [
+		"detection.is_triaged",
+		"detection.src_host.is_key_asset",
+		"detection.grouped_details.events.is_normally_accessed_by_rdp",
+		"detection.grouped_details.connection_events.is_external"
+	]
+}