Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Lastline Custom Threat Intelligence API Quick Start Guide (900146)

Last Updated: 9/20/2019Categories: InformationalTotal Views: 1284Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

Types of Intelligence

The Lastline custom intelligence API supports the following types of intelligence

Denylist IPs:

A NSX Lastline Sensor will generate events when it detects traffic to these IPv4 addresses.

Denylist Domains:

A NSX Lastline Sensor will generate events when it detects DNS requests for these domains or traffic to IPs resolved from these domains.

IDS Rules:

A NSX Lastline Sensor will generate events when these IDS rules match against the monitored network traffic. In addition to the rules themselves, the custom intelligence API supports variables for the custom IDS rules as well as references for documenting the rules.

IDS Rule variables:

The custom IDS rules provided by a customer may include variables. The values for these variables are then provided as a separate feed. This allows a customer to, for example, define a rule at the global scope and specialize it on each sensor with different variable values defined at the sensor scope.

IDS Rule references:

The custom IDS rules provided by a customer may include shorthand references to resources such as the CVE archive. The custom intelligence API allows users to define the mapping between reference keywords (such as “cve”) and the URL prefix used to resolve the reference URL (such as “https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-”). These mappings are treated just like another entity type, although they can only be defined at the global scope.

Scope of Intelligence

The NSX Lastline Intelligence API allows a user with multiple NSX Lastline Appliances to specify different intelligence for each appliance. When adding intelligence entries through the API, users must select one of the following scopes:

Global Scope:

The intelligence entries in the global scope apply to all of the user’s appliances.

License Scope:

The intelligence entries in the license scope apply to all a user’s appliance configured with a specified NSX Lastline license.

Sensor Scope:

The intelligence entries in the sensor scope apply only to a specific sensor.

Scope Examples

Sensor Scope

client.intel.delete_domain(['www.xyz.com'], ‘XXXXXXXXXXXXXXXXX:sensor01')

License Scope

client.intel.delete_domain(['www.xyz.com'], ‘XXXXXXXXXXXXXXXXX')

Global Scope

client.intel.delete_domain(['www.xyz.com'])

NSX Lastline Threat Intelligence Documentation

https://user.lastline.com/papi-doc/api/LastlineAPI.pdf (see section 12)

https://user.lastline.com/papi-doc/api/html/intel/overview.html

Sample API clients can be downloaded here:

https://user.lastline.com/papi-doc/api/client/papi_client.tar.gz

Setting the HOME_NET variable

1. Select the Admin Tab

2. Select the Custom Intelligence Menu Item

3. Select IDS Rule Variables

4. Refer to scoping rules described above. We will set the HOME_NET variable for the entire customer. Enter HOME_NET in the Variable Name field.

5. Next, enter the address or network segment using CIDR notation.

6. Hit the Tab key to enter the address in the text box. Repeat for all required entries in the HOME_NET variable.

7. When complete, press the Create Rule button.

8. You have now set the HOME_NET variable with Customer scope.

Python Client Configuration and Authentication Instructions

Download the papi_client.tar.gz file

Uncompress papi_client.tar.gz

Place the following files in the same directory.

papi_client.ini.template

papi_shell.py

<<Sample papi_client.ini file>>

test@lastline$ more papi_client.ini

[papi]
# For hosted server use this URL.
# For on-premise, adapt with host name of manager (https://user.<Manager Host Name>/papi)
url = https://user.lastline.com/papi

# Either user-based,
auth_method = account
username = [email-masked]
password = password

# or license/key based
# auth_method = license
# api_key = 12345...45123451234512345
# api_token = ***********

verify_ssl = True
timeout = 3

Establishing a Connection

test@lastline$ python papi_shell.py

---------------------------------------------------------
Lastline PAPI shell
---------------------------------------------------------

The 'client' object is a PapiClientCollection,
which provides access to the functionality
of the individual API views.

Views currently available are:

- 'client.intel': Custom intelligence API

This is an IPython shell, so you can take
advantage of tab auto-completion and other
convenient features of IPython.

E.g.:

Typing the command 'client.intel?' followed by a RETURN,
will print documentation for the intel API client,
while typing 'client.intel' followed by TAB will present
auto-completion options
(the list of methods of the intel client).

---------------------------------------------------------

In [3]: client.intel.
client.intel.add_domain                client.intel.feed_ip
client.intel.add_ids_rule              client.intel.get_domain
client.intel.add_ids_rule_variable     client.intel.get_ids_rule
client.intel.add_ip                    client.intel.get_ids_rule_variable
client.intel.client_from_config        client.intel.get_ip
client.intel.delete_domain             client.intel.list_domain
client.intel.delete_ids_rule           client.intel.list_ids_rule
client.intel.delete_ids_rule_variable  client.intel.list_ids_rule_variable
client.intel.delete_ip                 client.intel.list_ip
client.intel.feed_domain               client.intel.module_name
client.intel.feed_ids_rule             client.intel.name
client.intel.feed_ids_rule_variable    client.intel.ping

How to Add a Single IP Address to the Blacklist (All Sensors)

Note: XXXXXXXXXXXXXXXXXXXX represents the Lastline Sensor license key in all of the examples displayed below.

In [3] : client.intel.add_ip([{"ip": "4.2.2.2", "source": "Lastline", "comment": "this is my test", "impact": "90"}], ‘XXXXXXXXXXXXXXXXXXXX')
Logging in...
Starting new HTTPS connection (1): user.lastline.com
"POST /papi/login HTTP/1.1" 200 33
Request took 773 ms
Completed.
Doing POST request to https://user.lastline.com/papi/intel/ip/add.json
"POST /papi/intel/ip/add.json HTTP/1.1" 200 80
Request took 429 ms
Out[3]: {u'added': 1, u'errors': [], u'unchanged': 0,

How to Add a Single IP Address to the Blacklist (single sensor using sensor sub-key)

In [7]: client.intel.add_ip([{"ip": "4.2.2.4", "source": "Lastline", "comment": "this is my test", "impact": "90"}], 'XXXXXXXXXXXXXXXXXXXX', 'sensor01')
Doing POST request to https://user.lastline.com/papi/intel/ip/add.json
"POST /papi/intel/ip/add.json HTTP/1.1" 200 80
Request took 418 ms
Out[7]: u'{"success": 1, "data": {"errors": [], "updated": 0, "added": 1, "unchanged": 0}}'

How to Add a Single IP Address to the Blacklist (multiple sensors using sensor sub-keys)

In [2]: client.intel.add_ip([{"ip": "4.2.2.4", "source": "Lastline", "comment": "this is my test", "impact": "90"}], 'XXXXXXXXXXXXXXXXX', ['sensor01', 'sensor2'])
Logging in...
Starting new HTTPS connection (1): user.lastline.com
"POST /papi/login HTTP/1.1" 200 33
Request took 903 ms
Completed.
Doing POST request to https://user.lastline.com/papi/intel/ip/add.json
"POST /papi/intel/ip/add.json HTTP/1.1" 200 80
Request took 393 ms
Out[2]: u'{"success": 1, "data": {"errors": [], "updated": 0, "added": 0, "unchanged": 1}}'

How to Add Multiple IP Addresses to the Blacklist

In [27]: client.intel.add_ip ([{"ip": "10.1.1.1", "source": "Lastline", "comment": "this is my test", "impact": "90"},{"ip": "10.1.1.18", "source": "Lastline", "comment": "this is my test", "impact": "80"}],'XXXXXXXXXXXXXXXXXXXX')

How to Use Get IP

In [12]: client.intel.get_ip('4.2.2.2', 'XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/ip/get.json
"GET /papi/intel/ip/get.json?ip=4.2.2.2&key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 187
Request took 273 ms
Out[12]:
{u'account': [email-masked]',
u'comment': u'this is my test',
u'impact': 90,
u'ip': u'4.2.2.2',
u'last_modified': u'2014-11-18 19:19:11',
u'source': u'Lastline'}

How to Use Delete IP

In [12]: client.intel.delete_ip(['4.2.2.2'], ‘XXXXXXXXXXXXXX')
Doing POST request to https://user.lastline.com/papi/intel/ip/del.json
Resetting dropped connection: user.lastline.com
"POST /papi/intel/ip/del.json HTTP/1.1" 200 66
Request took 585 ms
Out[12]: {u'deleted': 1, u'errors': [], u'missing': 0}

How to Use List IP

In [10]: client.intel.list_ip('XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/ip/list.json
"GET /papi/intel/ip/list.json?key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 189
Request took 412 ms
Out[10]:
[{u'account': [email-masked]',
u'comment': u'this is my test',
u'impact': 90,
u'ip': u'4.2.2.2',
u'last_modified': u'2014-11-18 19:19:11',
u'source': u'Lastline'}]

How to Use Feed IP

In [8]: client.intel.feed_ip('XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/ip/feed.json
"GET /papi/intel/ip/feed.json?key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 212
Request took 1050 ms
Out[8]:
{u'add': [{u'entry_key': u'4.2.2.2', u'impact': 90},
{u'entry_key': u'4.2.2.3', u'impact': 90},
{u'entry_key': u'4.2.2.4', u'impact': 90}],
u'new_version': 1416407702,
u'old_version': 0,
u'remove': []}

How to Add a Domain to the Blacklist

In [7]: client.intel.add_domain([{"domain":"www.xyz.com", "source":"Lastline", "comment":"This is a test domain", "impact":"90"}], 'XXXXXXXXXXXXXXXXXXXX')
Doing POST request to https://user.lastline.com/papi/intel/domain/add.json
"POST /papi/intel/domain/add.json HTTP/1.1" 200 41
Request took 800 ms
Logging in...
"POST /papi/login HTTP/1.1" 200 33
Request took 162 ms
Completed.
Doing POST request to https://user.lastline.com/papi/intel/domain/add.json
"POST /papi/intel/domain/add.json HTTP/1.1" 200 80
Request took 452 ms
Out[7]: {u'added': 1, u'errors': [], u'unchanged': 0, u'updated': 0}

How to Use Get Domain

In [9]: client.intel.get_domain('www.xyz.com', 'XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/domain/get.json
"GET /papi/intel/domain/get.json?domain=www.xyz.com&key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 201
Request took 379 ms
Out[9]:
{u'account': [email-masked]',
u'comment': u'This is a test domain',
u'domain': u'www.xyz.com',
u'impact': 90,
u'last_modified': u'2014-11-19 14:02:01',
u'source': u'Lastline'}

How to Use Delete Domain

In [15]: client.intel.delete_domain(['www.xyz.com'], ‘XXXXXXXXXXXXXXXXX')
Doing POST request to https://user.lastline.com/papi/intel/domain/del.json
"POST /papi/intel/domain/del.json HTTP/1.1" 200 66
Request took 772 ms
Out[15]: {u'deleted': 1, u'errors': [], u'missing': 0}

How to Use List Domain

In [13]: client.intel.list_domain('XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/domain/list.json

"GET /papi/intel/domain/list.json?key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 203
Request took 461 ms
Out[13]:
[{u'account': [email-masked]',
u'comment': u'This is a test domain',
u'domain': u'www.xyz.com',
u'impact': 90,
u'last_modified': u'2014-11-19 14:02:01',
u'source': u'Lastline'}]

How to Use Feed Domain

In [9]: client.intel.feed_domain('XXXXXXXXXXXXXXXXXXXX')
Doing GET request to https://user.lastline.com/papi/intel/domain/feed.json
"GET /papi/intel/domain/feed.json?key=XXXXXXXXXXXXXXXXXXXX HTTP/1.1" 200 136
Request took 451 ms
Out[9]:
{u'add': [{u'entry_key': u'www.xyz.com', u'impact': 90}],
u'new_version': 1416407767,
u'old_version': 0,
u'remove': []}

How to Use the add_custom_intel_csv.py Script to Add Domains and IPs from a CSV File

The example below shows how to add multiple domains to the blacklist. If IP addresses need to be added to the blacklist, change DOMAIN to IP (ie. "IP,IMPACT,SOURCE,COMMENT").

test@lastline$ python add_custom_intel_csv.py -c papi_client.ini test.csv "DOMAIN,IMPACT,SOURCE,COMMENT" XXXXXXXXXXXXX

Completed.

Doing POST request to https://user.lastline.com/papi/intel/domain/add.json

"POST /papi/intel/domain/add.json HTTP/1.1" 200 80

Request took 1115 ms

{u'updated': 0, u'errors': [], u'unchanged': 0, u'added': 4}

add_custom_intel_csv.py options

python add_custom_intel_csv.py

usage: add_custom_intel_csv.py [-h] [-c CONFIG] [--impact IMPACT]

[--source SOURCE] [--comment COMMENT]

[--skip-header SKIP_HEADER] [--limit LIMIT]

[--test]

INPUT.CSV FORMAT [key]

Sample CSV File

domain.com,70,Lastline,test-comment

domain2.com,80,Lastline-New,test-comment2

domain3.com,90,Lastline-New2,Test-comment3

domain4.com,90,Lastline-New3,Test-comment4

User Defined Denylist Event

How To Add a Custom IDS Rule

In [52]: client.intel.add_ids_rule([{'rule' : 'alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"LASTLINE Command&Control: (Trojan) Sality";flow:established,to_server; content:"GET"; nocase; http_method; content:"GET "; content:"/xxxxxxxx"; threshold: type limit, track by_src, seconds 180, count 1; reference:url,www.lastline.com; classtype:trojan-activity; sid:101; rev:1;)' , 'source' : 'custom-ids' , 'impact' : 80 }])

Doing POST request to https://user.lastline.com/papi/intel/ids_rule/add.json

Resetting dropped connection: user.lastline.com

"POST /papi/intel/ids_rule/add.json HTTP/1.1" 200 80

Request took 1136 ms

Out[52]: {u'added': 1, u'errors': [], u'unchanged': 0, u'updated': 0}

In [53]: client.intel.list_ids_rule()

Doing GET request to https://user.lastline.com/papi/intel/ids_rule/list.json

"GET /papi/intel/ids_rule/list.json HTTP/1.1" 200 None

Request took 313 ms

Out[53]:

[{u'account': [email-masked]',

u'classification': u'trojan-activity',

u'customer_rule': u'alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"LASTLINE Command&Control: (Trojan) Sality";flow:established,to_server; content:"GET"; nocase; http_method; content:"GET "; content:"/xxxxxxxx"; threshold: type limit, track by_src, seconds 180, count 1; reference:url,www.lastline.com; classtype:trojan-activity; sid:101; rev:1;)',

u'group_id': 0,

u'impact': 80,

u'last_modified': u'2014-12-23 14:56:29',

u'message': u'LASTLINE Command&Control: (Trojan) Sality',

u'refs': u'url:www.lastline.com',

u'revision_id': 1,

u'rule_id': 101,

u'sensor_rule': u'alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"LASTLINE Command&Control: (Trojan) Sality"; flow:established,to_server; content:"GET"; nocase; http_method; content:"GET "; content:"/xxxxxxxx"; threshold: type limit, track by_src, seconds 180, count 1; reference:url,www.lastline.com; classtype:trojan-activity; sid:370000004; rev:1; gid:42;)',

u'signature_id': 370000004,

u'source': u'custom-ids'}]

How to Display the Custom Denylist

Log into the sensor and run the following commands.

cd /var/log

llintelclient.py --display-bl /var/log/llpsv_cust.dat

How to Fetch the Custom Denylist

The following command will check for customer-provided intelligence updates, install them if available, and make sure all affected components become aware of the new intelligence. The command needs to run as root.

llintelclient.py --fetch-cust-bl --fetch-cust-rules

Copy the papi_client.ini.template file to papi_client.ini. The papi_client.ini file needs to be in the same directory as the papi_shell.py script or the path will need to be provided.

Modify papi_client.ini to use either user-based or license/key based authentication (example below uses user-based authentication). The papi_shell.py script will use the authentication method defined in the papi_client.ini file.  Please note that user-based (not license based) authentication should be used when using the Lastline Custom Threat Intelligence API.

Please note that in some cases Requests will need to be installed. Requests is a HTTP library written in Python. (http://docs.python-requests.org/en/latest/)

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
修改在 vSAN 数据存储中的快照上运行的虚拟机上的存储策略规则 (70797)

KB
•
Windows 10 Wi-Fi プロファイルがインストールされない (85058)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX Detonator

VMware NSX Defender

Related Versions:

Take Our Survey

Support Assistant