Ingest STIX data from an Amazon S3 bucket

[salty]

I wish to pull STIX 2.0 JSON formatted logs from an Amazon S3 Bucket into the SIEM. Is there any guidance on how I can achieve this? We are not an Amazon customer but a solution we use from a 3rd party dumps its data into an S3 that we have access to.

[pbpillai]

We do not support STIX 2.0 JSON format.

Currently, we support only STIX 1.1 in XML format.

This would be a productive enhancement request as per KB60021.

Regards,

Prashanth B Pillai

Mcafee Technical Support 

Customer Success Group

[salty]

Thanks. Added STIX 2 as an idea.

However I still want to get data out of an S3 bucket, convert from STIX 2 into a format the SIEM likes, and get it into the SIEM. Any suggestions?

Do I need to start thinking about things like using logstash to pull the data, convert it, store it somewhere the SIEM can access?

[pbpillai · Accepted solution]

For STIX 1.1 xml format we can configure Cyber Threat Feeds in the ESM properties and send it to the IOC (Indicator of Compromise) engine.

We can then setup watchlists for the respective cyber thread feeds and view the feeds on the dashboard as well as generate alarms.

I may need to check internally on converting the STIX 2.0 format.