TruSTAR is an intelligence management platform that helps enterprises easily enrich and operationalize their security data. The platform uses Enclave architecture to fuse and correlate intelligence sources, helping analysts speed investigations and simplify workflows

Connect TruSTAR with LogicHub

1. Navigate to Automations > Integrations.
2. Search for TruSTAR.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • User API Key: The API key used to connect to the TruSTAR.
   • User API Secret: The API Secret used to connect to the TruSTAR.
4. After you've entered all the details, click Connect.

Actions for TruSTAR

Search Indicators

Searches for all indicators that contain the given search term. Also allows filtering by date, enclave, and tags. Results are maximum of 10,000 records and ordered by last seen time, descending.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: List of indicators.

Get Indicator Metadata

Provide metadata associated with an indicator.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Details of indicator

Find Correlated Reports

Find a list of all reports that contain any of the provided indicator values.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Reports

{
  "created": 1604645086742,
  "distributionType": "ENCLAVE",
  "enclaveIds": [
    "7a33144f-aef3-442b-87d4-dbf70d8afdb0"
  ],
  "error": null,
  "has_error": false,
  "id": "a55b18f6-c93d-45c1-acb7-0d2f741eb421",
  "timeBegan": 1604645086713,
  "title": "TLP AMBER BEC Share 11/5",
  "updated": 1604645086742
}

Search Reports

Searches for all reports that contain the given search term. Also allows filtering by date, enclave, and tags. Results are ordered by updated time, descending.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: List of reports.

Get Report Details

Finds a report by its internal or external id.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Report Details

Get Tags For Report

Returns the list of tags that a specified report has been tagged with. The enclave ID of each tag is simply the enclave ID of the report.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Report Tags

Get Indicators For Report

Returns a list of all indicators contained in a specified report.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Report Indicators

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem