Darktrace Plugin for Threat Exchange

This document explains how to configure the Darktrace v1.0.0 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin fetches IoCs of type Domains, FQDNs, Hostnames, IPv4 and IPv6 from the Watched Domains and IPs page in Darktrace. This plugin supports sharing Domains, FQDNs, Hostnames, IPv4 and IPv6 to Watched Domains and IPs page. This plugin supports pull and push retraction of IoCs from Darktrace.

Prerequisites

• A Netskope tenant (or multiple, for example, production and development/test instances)
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured
• Darktrace instance
• Connectivity to the following hosts: https://<region>.cloud.darktrace.com/

Darktrace Plugin Support

This plugin fetches IoCs of type Domains, FQDNs, Hostnames, IPv4 and IPv6 from the Watched Domains and IPs page in Darktrace. This plugin supports sharing Domains, FQDNs, Hostnames, IPv4 and IPv6 to Watched Domains and IPs page. This plugin supports pull and push retraction of IoCs from Darktrace.

Mappings

Pull Mappings

Reputation Mappings for Pulled IoCs

Push Mappings

Reputation Mappings for Shared IoCs

IoC Retraction

• IoC Retraction (Pull): Indicators will be fetched from Darktrace and in the subsequent pull cycles if some indicators are deleted on Darktrace, then they will be marked as Retraced in Netskope Cloud Exchange.
• IoC Retraction (Push): Retracted indicators present on Cloud Exchange will be deleted from <third-party platform> during sharing.

Permissions

You need these permissions:

• Edit Domains 
• Visualizer 
• Edit Tags 

[
    "Default",
    "threatintel",
    "external",
    "cloud-exchange",
    "netskope"
]

[
    {
        "name": "101.44.42.56",
        "strength": "45",
        "description": "malicious IP",
        "source": "threat"
    },
    {
        "name": "db-08a3ed2f40.corp-internal.local",
        "hostname": true,
        "strength": "45",
        "description": "malicious hostname",
        "source": "threat"
    },
]

{
    "addlist": "malsite.malware.com,exploit.com,76.83.2.190",
    "description": "Netskope CE | <3rd party plugin name>",
    "strength": 50,
    "source": "external-source"
}

{
    "response": "SUCCESS",
    "added": 3,
    "updated": 0,
    "addedList": [
        "malsite.malware.com",
        "exploit.com",
        "76.83.2.190"
    ]
}

{
    "removeentry": "db-08a3ed2f40.corp-internal.local",
    "source": "threatintel"
}

{
    "response": "SUCCESS"
}

Performance Matrix

Here is the performance reading conducted by pulling and sharing 100K indicators from/to Darktrace on a Large Cloud Exchange stack with these specifications.

User Agent

netskope-ce-6.0.1-cte-darktrace-v1.0.0

Workflow

1. Create a user on Darktrace.
2. Get your Public Token and Private Token.
3. Configure the Darktrace plugin.
4. Configure a Business Rule.
5. Configure Sharing.
6. Validate the Darktrace plugin.

Watch a Video

Click play to watch a video:

Create a User on Darktrace

1. Log in to your Darktrace instance and go to Admin > Permissions Admin.

   

2. Go to Created Accounts and click Create new user.

   

3. Enter a username and password, and then click User Template.

   

4. For Select a user template, select None.

   

5. Make sure all toggles are checked on the Threat Tray Behavior Categories page.

   

6. Make sure all toggles are checked on the Flags page.

   

7. Provide Edit Domains, Visualizer, and Edit Tags permissions, and then click Summary.

   

8. Click Create new account.

   

Get your Public Token and Private Token

1. Log in with the user account you just created and go to Account Settings.

   

2. Click API Access and copy the generated Public and Private tokens. These are needed for configuring the Darktrace plugin.

   

Configure the Darktrace Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Darktrace v1.0.0 (CTE) plugin.

   

3. Enter the Basic Information:
   • Configuration Name: Plugin configuration name.
   • Sync Interval: Interval to fetch data from this plugin source.
   • Indicator Aging Criteria: Expire indicators after a specific time.
   • Override Reputation: Set value to override reputation of indicators received from this configuration. Leave empty to keep default.
   • Enable SSL Validation: Enable SSL Certificate validation.
   • Tags Aggregate Strategy: Choose whether to append new tags to existing IoC(s) or overwrite them. This configuration parameters determine how tags are stored for indicators pulled for this configuration.

   

4. Click Next and enter the Configuration Parameters:
   • Base URL: Base URL of Darktrace instance.
   • Public Token: Public token generated from the Darktrace platform.
   • Private Token: Private token generated from the Darktrace platform.
   • Source Name: Name of the Intel Feed source from where the IoCs are to be pulled. Enter only one source name for this parameter. Available sources can be found on the Intel > Watched Domains page.
   • Enable Polling: Enable/Disable polling Threat IoCs from Darktrace. Disable if you only need to push Threat IoCs to Darktrace.

   

5. Click Save.

   

Configure a Threat Exchange Business Rule for Darktrace

A Business Rule is used to filter out the indicators that are to be shared. In order to share IoCs with Darktrace, create a business rule:

1. In Threat Exchange, go to Business Rules and click Create New Rule.
2. Enter a Rule name and select the fields for which you want to filter the IoCs.

   

3. Click Save.

Configure Threat Exchange Sharing for Darktrace

Add an IoC to the Intel Feed Source Action. To configure the Sharing:

1. In Threat Exchange, go to Sharing and click Add Sharing Configuration.
2. Select a Source (Source from which you want to share data to Darktrace), a Business Rule, and a Destination.
3. Select the Target value and set Action parameters per your requirements.
   • Source Name: Intel feed source name where IoCs are to be added. Select Create new source to create a new source on Darktrace platform.
   • Custom Source: Name of the custom source to create if it does not exist.
   • Exact Hostnames: Set to true to treat the added items as hostnames rather than domains. Does not apply to IoC of type IP. Note that, for IoCs of type hostname, it will always be True even if the sharing is configured with Exact Hostnames as false.
   • Flag for Response: Enable automatic triggering of a Darktrace Autonomous Response Action if the entry is seen.
4. Click Save.

   

Validate the Darktrace Plugin

Validate the Pull

Indicators from Darktrace are pulled from the Watched Domains and IPs page.

Log in to your Darktrace instance.

Go to Intel > Watched Domains.

Indicators stored in Cloud Exchange can be verified at Threat Exchange > Threat IoCs. Search for the Darktrace IoCs by filtering indicators from Darktrace.

Example: Add a query like “sources.source Is equal “CTE Darktrace” && type IN (“<IOC_TYPE>”)”.

You can also verify the indicators pulled in Cloud Exchange from the logs available at Logging.

Validate the Push

Shared IoCs to Darktrace can be verified from logs available at Logging. 

To validate shared IoCs on Darktrace, go to Intel > Watched Domains.

To verify the original source of indicator from which this was pulled in Cloud Exchange and shared to Darktrace, check the Description for that particular IoC.

For example, if an indicator is shared from Threat Exchange to Darktrace, then it will be shown as Netskope CE | Netskope Threat Exchange on Darktrace’s Description for that particular IoC. 

When the IoCs shared from Darktrace to the Netskope Tenant or 3rd-party platform are retracted, then they will be marked as <plugin-config-name>: retracted in the Retraction Result. If they are not deleted from the 3rd-party platform, the Retraction Result will be pending.

Validate the Retraction

To verify the Retracted IoCs from Darktrace, check the logs for IoC Retraction. Example: “message Like CTE Darktrace [configuration_name] [Retraction]“. 

Example log for push retraction:

To check the retracted IoCs in Cloud Exchange, go to Threat IoCs and search for “sources.source Like “CTE Darktrace” && sources.retracted Is equal true”. 

This plugin also supports push retraction, which means IoCs pulled from Netskope or 3rd-party platforms that were shared to the Darktrace platform, and were marked as retracted in Cloud Exchange, will also get deleted from the shared platform if that platform supports deletion of IoCs. You can verify the same through the Retraction result field. 

Troubleshooting the Darktrace Plugin

Receiving an error while configuring the plugin

There’s an issue while configuring the Darktrace plugin.

What to do:

Make sure the correct credentials are provided. Follow these steps to generate credentials.

Unable to pull data from the Darktrace Platform

You are getting an error while pulling the data from the Darktrace plugin.

What to do:

1. Go to the Logging page, verify if any error has occurred and try to fix it.
2. Verify that the Public Token and Private Token are not expired.

Not able to share IoCs from Cloud Exchange to Darktrace

If you are not able to share IoCs from Netskope to Darktrace, that could be due to one of these reasons:

• The IoCs present for Netskope plugin are of invalid type.
• Public Token and Private Token are expired.

What to do:

1. Make sure that valid types of IoCs are present. Darktrace supports sharing Domains, FQDNs, Hostnames, IPv4 and IPv6 to the Watched Domains and IPs page.
2. Make sure that Public Token and Private Token are not expired.

Known Behaviors

• Darktrace plugin will pull all IoCs from the set source name in each sync interval, due to which the Hit count for all IoCs will increase by 1 after each sync interval.
• While deleting IoC from Darktrace (Push Retraction) source name is a required parameter.
  Example:
  • Initial State:
    • Action 1 (Source 1): Filters and pushes IoCs 1–5.
    • Action 2 (Source 2): Filters and pushes IoCs 6–10.
  • Retraction Event:
    • IoCs 1, 2, 6, and 7 are marked as retracted.
  • Current Core Behavior:
    • The plugin receives the list of retracted indicators like [1, 2, 6, 7] and a list of configured actions [Action 1(Source 1), Action 2 (Source 2)]
  • The Conflict: The plugin does not know that 1 and 2 belong to Source 1, while 6 and 7 belong to Source 2. It has no context to perform a targeted retraction.
  • Current Implementation: The plugin will delete IoCs 1,2,6 and 7 from both Source 1 and Source 2. 

• Another issue related to the above case is that if no actions are configured (were initially configured and IoCs were pushed using them, but are now deleted), IoC retraction will not work because there an not any Source names to delete IoCs from.
• To prevent a scenario where an IoC is pushed and pulled repeatedly between systems, the plugin implements a specific safeguard:

  If the IoC pushed from Cloud Exchange is pulled back in Cloud Exchange from Darktrace, it would be due to the description of the IoC being updated manually or via any 3rd-party entity source API. The plugin checks the IoC description and looks for the source label, like Netskope CE|<plugin_name>, when an IoC is pushed from Cloud Exchange. If this source label is not found in the IoC, it will be pulled in Cloud Exchange.