Connector vt livehunt

[gkallenborn]

Proposed changes

I enhanced the VirusTotal Livehunt Notifications connector.

• For each retrieved file, the code can now look for malware configurations and extract the C2 infrastructure data (domain, IP, URL) which are added to the STIX bundle.
• Indicators can also be automatically created, based on the malware config observables.
• The code can add a TLP marking to all STIX entities in the bundle.
• It is possible to limit the number of notifications to process per run, which can be useful if the VT API quota is small.

This enhancement is totally optionnal and can be configured through 7 new parameters:

• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_GET_MALWARE_CONFIG=False # (Optional) Set to true to add config data of malware files like IPs and domains, if present. Only works if file creation is enabled. Default is false
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_TLP=GREEN # (Optional) Set the TLP level for created entities, e.g. WHITE, GREEN, AMBER, AMBER_STRICT or RED
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_CREATE_FILE_INDICATORS=False # (Optional) Set to true to create file indicators from the matched file. Default is false
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_CREATE_DOMAIN_NAME_INDICATORS=False # (Optional) Set to true to create indicators from the domain names extracted from the malware config. Default is false
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_CREATE_IP_INDICATORS=False # (Optional) Set to true to create indicators from the IP addresses extracted from the malware config. Default is false
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_CREATE_URL_INDICATORS=False # (Optional) Set to true to create indicators from the URLs extracted from the malware config. Default is false
• VIRUSTOTAL_LIVEHUNT_NOTIFICATIONS_LIMIT=100 # (Optional) Maximum number of notifications to process per run

Related issues

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[gkallenborn]

Due to an error, the first commit is not verified, but I reverted it. So all commits are in fact verified.