MistNet provides a machine learning (ML)-driven network threat detection and response solution and a built-in MITRE ATT&CK™ Engine that eliminates blind spots and monitors your organization’s network in real time.

Connecting with MistNet with LogicHub

1. Navigate to Automations > Integrations.
2. Search for MistNet.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • Customer Name: Customer name to access MistNet.
   • Certificate: Upload Certificate to access MistNet.
   • *Passphrase`* (Optional): Passphrase to access MistNet.
4. After you've entered all the details, click Connect.

Actions for MistNet

IOAs Search

Retrieve IOAs objects.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: IOAs Objects

{
  "result": {
    "took": 48,
    "timed_out": false,
    "_shards": {
      "total": 128,
      "successful": 128,
      "skipped": 0,
      "failed": 0
    },
    "hits": {
      "total": 1,
      "max_score": null,
      "hits": [
        {
          "_index": "c-ioas",
          "_type": "doc",
          "_id": "258f-e19f-af87-c911cd",
          "_score": null,
          "_source": {
            "entry_source": "c-chicago-0-0",
            "entry_uuid": "2520f-e19f-af87-c912d1cd",
            "src": "11.78.77.0",
            "entry_origin": "Analysis Engine",
            "dest": "11.78.0.0",
            "entry_type": "Connection",
            "timestamp": 1615597364466
          },
          "sort": [
            1615597364466
          ]
        }
      ]
    }
  },
  "error": null,
  "has_error": false
}

Raw Logs Search

Retrieve raw logs objects.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Raw Logs Objects

{
  "result": {
    "took": 48,
    "timed_out": false,
    "_shards": {
      "total": 128,
      "successful": 128,
      "skipped": 0,
      "failed": 0
    },
    "hits": {
      "total": 1,
      "max_score": null,
      "hits": [
        {
          "_index": "raw-logs-2021.03.13",
          "_type": "doc",
          "_id": "258f-e19f-af87-c911cd",
          "_score": null,
          "_source": {
            "entry_source": "c-chicago-0-0",
            "entry_uuid": "2520f-e19f-af87-c912d1cd",
            "src": "11.78.77.0",
            "entry_origin": "Analysis Engine",
            "dest": "11.78.0.0",
            "entry_type": "Connection",
            "timestamp": 1615597364466
          },
          "sort": [
            1615597364466
          ]
        }
      ]
    }
  },
  "error": null,
  "has_error": false
}

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem