feat(reversinglabs-spectra-intel-submission): add to catalog (#6836)

internal-enrichment/reversinglabs-spectra-intel-submission/Dockerfile

@@ -7,10 +7,10 @@
 RUN pip3 install --no-cache-dir -r /tmp/requirements.txt
 
 # Copy the connector
-COPY src /opt/opencti-connector-reversinglabs-spectra-intelligence-file-submission
-WORKDIR /opt/opencti-connector-reversinglabs-spectra-intelligence-file-submission
+COPY src /opt/opencti-connector-reversinglabs-spectra-intel-submission
+WORKDIR /opt/opencti-connector-reversinglabs-spectra-intel-submission
 
 # Expose and entrypoint
 COPY entrypoint.sh /
 RUN chmod +x /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]

internal-enrichment/reversinglabs-spectra-intel-submission/__metadata__/CONNECTOR_CONFIG_DOC.md

@@ -0,0 +1,23 @@
+# Connector Configurations
+
+Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
+
+### Type: `object`
+
+| Property | Type | Required | Possible values | Default | Description |
+| -------- | ---- | -------- | --------------- | ------- | ----------- |
+| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) |  | The base URL of the OpenCTI instance. |
+| OPENCTI_TOKEN | `string` | ✅ | string |  | The API token to connect to OpenCTI. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_USERNAME | `string` | ✅ | string |  | ReversingLabs Spectra Intelligence username. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_PASSWORD | `string` | ✅ | Format: [`password`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) |  | ReversingLabs Spectra Intelligence password. |
+| CONNECTOR_NAME | `string` |  | string | `"ReversingLabs Spectra Intelligence Submission"` | The name of the connector. |
+| CONNECTOR_SCOPE | `array` |  | string | `["Artifact", "Url", "StixFile", "File"]` | The scope of the connector. |
+| CONNECTOR_LOG_LEVEL | `string` |  | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
+| CONNECTOR_TYPE | `const` |  | `INTERNAL_ENRICHMENT` | `"INTERNAL_ENRICHMENT"` |  |
+| CONNECTOR_AUTO | `boolean` |  | boolean | `false` | Whether the connector should run automatically when an entity is created or updated. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_URL | `string` |  | string | `"data.reversinglabs.com"` | ReversingLabs Spectra Intelligence API base URL. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_MAX_TLP | `string` |  | `TLP:WHITE` `TLP:CLEAR` `TLP:GREEN` `TLP:AMBER` `TLP:AMBER+STRICT` `TLP:RED` | `"TLP:AMBER"` | Maximum TLP level for entities that the connector can enrich. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_OS | `string` |  | `windows7` `windows10` `windows11` `macos11` `linux` | `"windows10"` | The platform to execute the sample on. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_INTERNET_SIM | `boolean` |  | boolean | `false` | Enable internet simulation during sandbox analysis. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_CREATE_INDICATORS | `boolean` |  | boolean | `true` | Create STIX indicators from analysis results. |
+| REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_POLL_INTERVAL | `integer` |  | `250 <= x ` | `250` | Polling interval in seconds to check analysis results. |

internal-enrichment/reversinglabs-spectra-intel-submission/__metadata__/connector_config_schema.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.filigran.io/connectors/reversinglabs-spectra-intel-submission_config.schema.json",
+  "type": "object",
+  "properties": {
+    "OPENCTI_URL": {
+      "description": "The base URL of the OpenCTI instance.",
+      "format": "uri",
+      "maxLength": 2083,
+      "minLength": 1,
+      "type": "string"
+    },
+    "OPENCTI_TOKEN": {
+      "description": "The API token to connect to OpenCTI.",
+      "type": "string"
+    },
+    "CONNECTOR_NAME": {
+      "default": "ReversingLabs Spectra Intelligence Submission",
+      "description": "The name of the connector.",
+      "type": "string"
+    },
+    "CONNECTOR_SCOPE": {
+      "default": [
+        "Artifact",
+        "Url",
+        "StixFile",
+        "File"
+      ],
+      "description": "The scope of the connector.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "CONNECTOR_LOG_LEVEL": {
+      "default": "error",
+      "description": "The minimum level of logs to display.",
+      "enum": [
+        "debug",
+        "info",
+        "warn",
+        "warning",
+        "error"
+      ],
+      "type": "string"
+    },
+    "CONNECTOR_TYPE": {
+      "const": "INTERNAL_ENRICHMENT",
+      "default": "INTERNAL_ENRICHMENT",
+      "type": "string"
+    },
+    "CONNECTOR_AUTO": {
+      "default": false,
+      "description": "Whether the connector should run automatically when an entity is created or updated.",
+      "type": "boolean"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_URL": {
+      "default": "data.reversinglabs.com",
+      "description": "ReversingLabs Spectra Intelligence API base URL.",
+      "type": "string"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_USERNAME": {
+      "description": "ReversingLabs Spectra Intelligence username.",
+      "type": "string"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_PASSWORD": {
+      "description": "ReversingLabs Spectra Intelligence password.",
+      "format": "password",
+      "type": "string",
+      "writeOnly": true
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_MAX_TLP": {
+      "default": "TLP:AMBER",
+      "description": "Maximum TLP level for entities that the connector can enrich.",
+      "enum": [
+        "TLP:WHITE",
+        "TLP:CLEAR",
+        "TLP:GREEN",
+        "TLP:AMBER",
+        "TLP:AMBER+STRICT",
+        "TLP:RED"
+      ],
+      "type": "string"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_OS": {
+      "default": "windows10",
+      "description": "The platform to execute the sample on.",
+      "enum": [
+        "windows7",
+        "windows10",
+        "windows11",
+        "macos11",
+        "linux"
+      ],
+      "type": "string"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_INTERNET_SIM": {
+      "default": false,
+      "description": "Enable internet simulation during sandbox analysis.",
+      "type": "boolean"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_CREATE_INDICATORS": {
+      "default": true,
+      "description": "Create STIX indicators from analysis results.",
+      "type": "boolean"
+    },
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_POLL_INTERVAL": {
+      "default": 250,
+      "description": "Polling interval in seconds to check analysis results.",
+      "minimum": 250,
+      "type": "integer"
+    }
+  },
+  "required": [
+    "OPENCTI_URL",
+    "OPENCTI_TOKEN",
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_USERNAME",
+    "REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_PASSWORD"
+  ],
+  "additionalProperties": true
+}

internal-enrichment/reversinglabs-spectra-intel-submission/__metadata__/connector_manifest.json

@@ -1,4 +1,4 @@
 {
   "title": "ReversingLabs Spectra Intel Submission",
   "slug": "reversinglabs-spectra-intel-submission",
   "description": "Connector supports enrichment of observables and creation of indicators based on the result received from ReversingLabs Spectra Intelligence. Connector enables file submission to the Spectra Intelligence and file analysis. Based on the result, connector creates indicators, malwares, calculates score, adds labels, adds MITRE tactics and techniques and creates relationships between created objects for submitted observable.\nConnector enables file and url submission to the ReversingLabs Spectra Intelligence.\nThe connector works for the following observable types:",
@@ -14,7 +14,7 @@
   "support_version": ">=6.2.14",
   "subscription_link": null,
   "source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/internal-enrichment/reversinglabs-spectra-intel-submission",
-  "manager_supported": false,
+  "manager_supported": true,
   "container_version": "rolling",
   "container_image": "opencti/connector-reversinglabs-spectra-intel-submission",
   "container_type": "INTERNAL_ENRICHMENT"

internal-enrichment/reversinglabs-spectra-intel-submission/docker-compose.yml

@@ -3,20 +3,20 @@
   connector-reversinglabs-spectra-intel-submission:
     image: opencti/connector-reversinglabs-spectra-intel-submission:latest
     environment:
+      - OPENCTI_URL=http://localhost
+      - OPENCTI_TOKEN=ChangeMe
+      - CONNECTOR_ID=ChangeMe
       - CONNECTOR_NAME=ReversingLabs Spectra Intelligence Submission
       - CONNECTOR_SCOPE=Artifact,Url,StixFile,File
-      - OPENCTI_URL=http://localhost
-      - OPENCTI_TOKEN=Changeme
-      - CONNECTOR_ID=Changeme
       - CONNECTOR_CONFIDENCE_LEVEL=100 # From 0 (Unknown) to 100 (Fully trusted).
       - CONNECTOR_LOG_LEVEL=info
       - CONNECTOR_AUTO=false
-      - REVERSINGLABS_SPECTRA_INTELLIGENCE_URL=data.reversinglabs.com
-      - REVERSINGLABS_SPECTRA_INTELLIGENCE_USERNAME=Changeme
-      - REVERSINGLABS_SPECTRA_INTELLIGENCE_PASSWORD=Changeme
-      - REVERSINGLABS_MAX_TLP=TLP:AMBER
-      - REVERSINGLABS_SANDBOX_OS=windows10
-      - REVERSINGLABS_SANDBOX_INTERNET_SIM=false
-      - REVERSINGLABS_CREATE_INDICATORS=true
-      - REVERSINGLABS_POLL_INTERVAL=250
+      - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_URL=data.reversinglabs.com
+      - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_USERNAME=ChangeMe
+      - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_PASSWORD=ChangeMe
+      # - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_MAX_TLP=TLP:AMBER
+      # - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_OS=windows10
+      # - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_SANDBOX_INTERNET_SIM=false
+      # - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_CREATE_INDICATORS=true
+      # - REVERSINGLABS_SPECTRA_INTEL_SUBMISSION_POLL_INTERVAL=250
     restart: always

internal-enrichment/reversinglabs-spectra-intel-submission/entrypoint.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 # Correct working directory
-cd /opt/opencti-connector-reversinglabs-spectra-intelligence-file-submission
+cd /opt/opencti-connector-reversinglabs-spectra-intel-submission
 
 # Launch the connector
 python3 main.py

internal-enrichment/reversinglabs-spectra-intel-submission/requirements.txt

@@ -1,2 +1,4 @@
 pycti==7.260626.0
 reversinglabs-sdk-py3==2.11.4
+pydantic>=2.8.2,<3
+connectors-sdk @ git+https://github.com/OpenCTI-Platform/connectors.git@master#subdirectory=connectors-sdk

internal-enrichment/reversinglabs-spectra-intel-submission/src/__init__.py

@@ -0,0 +1,3 @@
+from connector.settings import ConnectorSettings
+
+__all__ = ["ConnectorSettings"]

internal-enrichment/reversinglabs-spectra-intel-submission/src/config.yml.sample

@@ -0,0 +1,22 @@
+opencti:
+  url: 'http://localhost:8080'
+  token: 'ChangeMe'
+
+connector:
+  id: 'ChangeMe'
+  type: 'INTERNAL_ENRICHMENT'
+  name: 'ReversingLabs Spectra Intelligence Submission'
+  scope: 'Artifact,Url,StixFile,File'
+  confidence_level: 100
+  log_level: 'info'
+  auto: false
+
+reversinglabs_spectra_intel_submission:
+  url: 'ChangeMe'
+  username: 'ChangeMe'
+  password: 'ChangeMe'
+  # max_tlp: 'TLP:AMBER'
+  # sandbox_os: 'windows10'
+  # sandbox_internet_sim: false
+  # create_indicators: true
+  # poll_interval: 250

internal-enrichment/reversinglabs-spectra-intel-submission/src/connector/__init__.py

@@ -0,0 +1,4 @@
+from connector.connector import ReversingLabsSpectraIntelConnector
+from connector.settings import ConnectorSettings
+
+__all__ = ["ConnectorSettings", "ReversingLabsSpectraIntelConnector"]