Link Search Menu Expand Document

Get New Blog Posts

Workflow #0001

This workflow consumes the Talos Intelligence Blog RSS feed and converts individual blog posts into SecureX casebooks. These casebooks can then be investigated with one click in Threat Response.

GitHub


Important Note

This workflow has two components: a parent workflow and a sub-workflow. Importing the parent will import both. We also provide the sub-workflow separately as Talos - Single Blog Post to SecureX Casebook.


Change Log

Date Notes
Nov 24, 2020 - Initial release
Feb 20, 2021 - Updated to use new sub-workflow based on updated workflow 0002
- Updated to use new Threat Response v2 atomics
- Fixed an issue where the Threat Response token could expire during investigation (Issue #2)
- Added auto-detection for the Threat Response environment URL
- Changed how the Webex message and casebook summary are generated to be more reliable and useful
Jun 24, 2021 - Updated the user agent header being used to fetch blog posts from Talos

See the Important Notes page for more information about updating workflows


Requirements

Note: You may have an old version of the Webex Teams - Post Message to Room atomic. To ensure the best experience with this workflow, be sure to import the latest version of this atomic from the GitHub_Target_Atomics repository!


Workflow Steps

This workflow is designed to run on a schedule to periodically check the Talos blog for new posts.

  1. Get the RSS feed XML
  2. If the Etag is the same or there aren’t any recent updates, end the workflow
  3. Get the updated Etag and Last-Modified headers
  4. Convert the feed XML into JSON and parse out each post’s information
  5. For each blog post:
    • Check if the post has been updated since the last run of the workflow (if not, skip it)
    • Run a sub-workflow to parse the single blog post
  6. Update the global variables with the new Etag and Last-Modified date

Sub-Workflow Steps

These steps are executed for each new or updated blog post the parent workflow discovers on the Talos blog.

  1. Fetch the blog post content and strip out any HTML
  2. Request a Threat Response access token and inspect the blog post content for observables
  3. Loop through each observable and get its Threat Response disposition
  4. For observables that weren’t clean, conduct Threat Response enrichment to get sightings
  5. For modules with sightings, build the text to post to Webex
  6. Create the Threat Response casebook and, if a teams room is provided, post a message to Webex

Configuration

  • If you want the workflow to run on a schedule, you need to create a schedule and then add it as a trigger within the workflow
  • See this page for information on configuring the workflow for Webex Teams

Targets

Parent Workflow

Target Name Type Details Account Keys Notes
Talos Intelligence Blog HTTP Endpoint Protocol: HTTPS
Host: feeds.feedburner.com
Path: /feedburner/Talos
None  

Sub-Workflow

Target Group: Default TargetGroup

Target Name Type Details Account Keys Notes
CTR_For_Access_Token HTTP Endpoint Protocol: HTTPS
Host: visibility.amp.cisco.com
Path: /iroh
CTR_Credentials Created by default
CTR_API HTTP Endpoint Protocol: HTTPS
Host: visibility.amp.cisco.com
Path: /iroh
None Created by default
Private_CTIA_Target HTTP Endpoint Protocol: HTTPS
Host: private.intel.amp.cisco.com
Path: None
None Created by default
Webex Teams HTTP Endpoint Protocol: HTTPS
Host: webexapis.com
Path: None
None Not necessary if Webex Teams activities are removed

Account Keys

Sub-Workflow

Account Key Name Type Details Notes
CTR_Credentials HTTP Basic Authentication Username: Client ID
Password: Client Secret
Created by default