Thales Plugin for Threat Exchange

This document explains how to configure the Thales v1.0.1 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch the IoCs of type IPv4 from the Application > Attack Analytics > Incidents page on the Thales platform. This plugin does not support sharing of IoCs to the Thales platform. This plugin supports retraction of IoCs pulled from the Thales platform.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
• A URL List on your Netskope tenant.
• A Destination Profile on your Netskope tenant.
• A Private App on your Netskope tenant.
• Connectivity to the Thales platform.
• A subscription for Thales Threat Response Module services.
• A user with the Manage API Key role to generate an API Key.
• For Secrets Manager configuration, refer to Secrets Manager. To set up Azure Key Vault Secrets Manager, refer to Prerequisites for Azure Key Vault Secrets Manager.
• Connectivity to the following host: https://api.imperva.com
• Your Thales account ID.

Thales Plugin Support

This plugin is used to fetch the IoCs of type IPv4 from the Application > Attack Analytics > Incidents page on the Thales platform. This plugin does not support sharing of IoCs to the Thales platform. This plugin supports retraction of IoCs pulled from the Thales platform.

IoC Retraction

IoC Retraction (Pull): Indicators are fetched from Thales. In the subsequent pull cycles, if the incidents of some indicators are deleted or marked as false positive on Thales, or the indicators are not in the specified Retraction Interval, they are marked as Retracted in Netskope Cloud Exchange.

Mappings

Pull Mappings

Severity Mappings for Pull

Permissions

Users should have the Manage API Key role to generate an API Key.

[
    {
        "id": "db0cfbe0-d8ca-11f0-1f46-8bef9ba73c98",
        "main_sentence": "Illegal Resource Access attack by a single IP from Bulgaria using Go HTTP library HackingTool ",
        "secondary_sentence": "On host \"Thales1.cdsys.io\" ",
        "false_positive": false,
        "events_count": 6,
        "events_blocked_percent": 0,
        "first_event_time": 1765702422735,
        "last_event_time": 1765702621854,
        "severity": "MINOR",
        "severity_explanation": "High risk, High confidence",
        "dominant_attack_country": {
            "country": "Bulgaria",
            "country_code": "BG",
            "dominance": "DOMINANT"
        },
        "dominant_attack_ip": {
            "ip": "195.178.110.158",
            "reputation": [
                "IP reputation Medium risk"
            ],
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attacked_host": {
            "value": "Thales1.cdsys.io",
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attack_tool": {
            "name": "Go HTTP library",
            "type": "Suspicious",
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attack_violation": "Illegal Resource Access",
        "only_custom_rule_based": true,
        "how_common": "SPRAY_AND_PRAY",
        "incident_type": "REGULAR"
    }
]

Performance Matrix

This reading is conducted on a Large Cloud Exchange Stack with these specs by pulling 100k IoCs from Thales.

User Agent

netskope-ce-7.0.0-cte-thales-v1.0.1

Workflow

1. Create an API ID and API Key on Thales.
2. Configure the Thales Plugin.
3. Add a Business Rule.
4. Configure Threat Exchange Sharing for Thales.
5. Validate the Thales Plugin.

Watch a Video

Click play to watch a video.

Create an API ID and API Key on Thales

1. Log in to Thales.

2. Go to Account > Account Management from the top right corner.

   

3. Go to User Management > My Profile.

   

4. Scroll down to API Keys and click Add API Key.

   

5. Enter a Name, select when the API key will expire in, and enable the status. Click Create.

   

6. Copy the API ID and API Key, and then click Close. These are used to configure the plugin.

Configure the Thales Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Thales v1.0.1 (CTE) plugin.

   

2. Enter the Basic Information:

   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Interval to fetch data from this plugin and share data to this plugin from other sources.
   • Aging Criteria: Expiry time of the plugin in days (Default: 90).
   • Override Reputation: Set a value to override the reputation of indicators received from this configuration.
   • Enable SSL Validation: Enable SSL Certificate validation.
   • Use System Proxy: Enable if the proxy is required for communication.
   It is better to have a larger value for Sync Interval if you want to pull IoCs in large numbers.

   

3. Click Next and enter the Configuration Parameters:

   • Account ID: Unique identifier for your account.
   • API ID: API ID generated from the Thales instance obtained previously.
   • API Key: API Key generated from the Thales instance obtained previously.
   • Enable Tagging: Enable/Disable tagging functionality.
   • Retraction Interval (in days): Number of days to use as the retraction interval for Thales indicator(s) pull retraction. This parameter applies only when IoC(s) Retraction is enabled in Threat Exchange Settings. Value must be between 1 and 1800.
   • Initial Range (in days): Number of days to pull the data for the initial run. Value must be between 0 and 1800. If you enter 0, no historical data is pulled.

   

4. Click Save. The plugin configuration appears on the Threat Exchange > Plugins page.

   

Add a Threat Exchange Business Rule for Thales Plugin

To share indicators fetched from Thales to the Netskope tenant, you need a business rule that filters the indicators that you want to share. To configure a business rule:

1. In Threat Exchange, go to Business Rules and click Create New Rule.

2. Add the filter according to your requirements in the rule, and then click Save.

   

Configure Threat Exchange Sharing for Thales

The Thales plugin does not support sharing of IoCs, but the IoCs pulled from this plugin can be shared to the Netskope Tenant or other 3rd-party platforms.

To share IoCs from Thales to Cloud Exchange:

1. In Threat Exchange, go to Sharing and click Add Sharing Configuration.

2. Select your Source Configuration (CTE Thales), a Business Rule, the Destination Configuration (CTE Netskope Threat Exchange), and Target.

   

3. Click Save.

   

For more information about all the actions supported on the Netskope tenant, refer to Threat Exchange Plugin.

Validate the Thales Plugin

Validate the Pull

Pulled data is listed on the Threat IoCs page. You can filter the IoCs pulled from the platform using the filter sources.source Like "<plugin configuration name>".

To verify pulled logs in Cloud Exchange, go to Logging and search for logs from the CTE Thales plugin with the filter message Like "CTE Thales".

To verify the data available for pulling on the Thales platform, log in to Thales and go to Application > Attack Analytics > Incidents.

To verify the details of a particular incident, click More details.

To verify the retracted IoCs, check the logs for IoC retraction, for example, message Like [Retraction].

You can filter the retracted IoCs from the platform using the filter sources.source Is equal "<plugin configuration name>" && sources.retracted Is equal true.

Validate the Push

Here you can see IoCs were added to the Destination Profile on the Netskope Tenant.

Then some of the shared IoCs were marked as retracted, so they were deleted from the profile.

Troubleshooting the Thales Plugin

Unable to pull IoCs from the Thales platform

After the plugin configuration, if the IoCs are not pulled from the platform, it might be due to one of these reasons:

• No IoCs are available on the platform to pull.
• IoCs are not available for the given configuration parameters (for example, Initial Range).

What to do: Identify your root cause from the list above and follow the matching steps:

• No IoCs are available on the platform to pull: Check if the IoCs are available on the platform to pull. If they are available, check the resolution for the next point.
• IoCs are not available for the given time range: If the IoCs are available on the platform to pull, but the plugin has not pulled the IoCs in Cloud Exchange, check the number of days in the Initial Range (in days) parameter of the plugin configuration. On the Thales platform, check if you have data for the given time range.