MistNet

MistNet provides a machine learning (ML)-driven network threat detection and response solution and a built-in MITRE ATT&CK™ Engine that eliminates blind spots and monitors your organization’s network in real time.

Integration with LogicHub

Connecting with MistNet

To connect to MistNet following details are required:

  • Label: Connection name.
  • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
  • Customer Name: Customer name to access MistNet.
  • Certificate: Upload Certificate to access MistNet.
  • Passphrase (Optional): Passphrase to access MistNet.

Actions with MistNet

IOAs Search

Retrieve IOAs objects.

Inputs to this Action

  • Connection: Choose a connection that you have created.
  • Jinja Template Start Time (Optional): Jinja-templated text containing the value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908
  • Jinja Template End Time (Optional): Jinja-templated text containing the value for end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908
  • Jinja Template Query (Optional): Jinja-templated query allows to specify what data should be fetched for a particular search. Example: { "{{field_name_column1}}": "{{field_value_column1}}", "{{field_name_column2}}": "{{field_value_column2}}" }
  • Jinja Template Sort By (Optional): Jinja-templated text containing comma separated list of fields based on which the search results need to be sorted (Default is timestamp). Example: [{"timestamp": {"order": "desc"}}, {"src": {"order": "{{column_value}}"}}]
  • Jinja Template Fields List (Optional): Jinja-templated text containing comma separated list of field values to be fetched for a particular search (Default is all fields). Example: {{column_value1}}, {{column_value2}}

Output of Action
JSON containing following items:

  • has_error: True/False
  • error: message/null
  • result: IOAs Objects
{
  "result": {
    "took": 48,
    "timed_out": false,
    "_shards": {
      "total": 128,
      "successful": 128,
      "skipped": 0,
      "failed": 0
    },
    "hits": {
      "total": 1,
      "max_score": null,
      "hits": [
        {
          "_index": "c-ioas",
          "_type": "doc",
          "_id": "258f-e19f-af87-c911cd",
          "_score": null,
          "_source": {
            "entry_source": "c-chicago-0-0",
            "entry_uuid": "2520f-e19f-af87-c912d1cd",
            "src": "11.78.77.0",
            "entry_origin": "Analysis Engine",
            "dest": "11.78.0.0",
            "entry_type": "Connection",
            "timestamp": 1615597364466
          },
          "sort": [
            1615597364466
          ]
        }
      ]
    }
  },
  "error": null,
  "has_error": false
}

Raw Logs Search

Retrieve raw logs objects.

Inputs to this Action

  • Connection: Choose a connection that you have created.
  • Jinja Template Index (Optional): Jinja-templated text containing the index, Usually a date(2021.03.03), allows to specify the index for a particular search (Default is ). This will append the index into requested url `-raw-logs-`. Example: '{{field_index_column}}'
  • Jinja Template Start Time (Optional): Jinja-templated text containing the value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908
  • Jinja Template End Time (Optional): Jinja-templated text containing the value for end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908
  • Jinja Template Query (Optional): Jinja-templated query allows to specify what data should be fetched for a particular search. Example: { "{{field_name_column1}}": "{{field_value_column1}}", "{{field_name_column2}}": "{{field_value_column2}}" }
  • Jinja Template Sort By (Optional): Jinja-templated text containing comma separated list of fields based on which the search results need to be sorted (Default is timestamp). Example: [{"timestamp": {"order": "desc"}}, {"src": {"order": "{{column_value}}"}}]
  • Jinja Template Fields List (Optional): Jinja-templated text containing comma separated list of field values to be fetched for a particular search (Default is all fields). Example: {{column_value1}}, {{column_value2}}

Output of Action
JSON containing following items:

  • has_error: True/False
  • error: message/null
  • result: Raw Logs Objects
{
  "result": {
    "took": 48,
    "timed_out": false,
    "_shards": {
      "total": 128,
      "successful": 128,
      "skipped": 0,
      "failed": 0
    },
    "hits": {
      "total": 1,
      "max_score": null,
      "hits": [
        {
          "_index": "raw-logs-2021.03.13",
          "_type": "doc",
          "_id": "258f-e19f-af87-c911cd",
          "_score": null,
          "_source": {
            "entry_source": "c-chicago-0-0",
            "entry_uuid": "2520f-e19f-af87-c912d1cd",
            "src": "11.78.77.0",
            "entry_origin": "Analysis Engine",
            "dest": "11.78.0.0",
            "entry_type": "Connection",
            "timestamp": 1615597364466
          },
          "sort": [
            1615597364466
          ]
        }
      ]
    }
  },
  "error": null,
  "has_error": false
}

Did this page help you?