Collect Anomali ThreatStream IOC logs

This document explains how to ingest Anomali ThreatStream IOC logs to Google Security Operations using an API. The parser transforms the IOC data from either JSON or CEF format into a unified data model (UDM). The code first attempts to parse the input as JSON, and if unsuccessful, checks for the "CEF:" prefix to process it as a CEF message, extracting IOC attributes and mapping them to UDM fields.

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• Privileged access to an Anomali ThreatStream enterprise tenant

Create a dedicated API user

1. Sign in to ThreatStream. Switch to the Classic UI if you are on Anomali Enterprise.
2. Go to Administration > Users.
3. Click + Add User (or select an existing service account).
4. Complete the following details:
   • Email: Service account email address (for example, anomali_ioc_secops@example.com).
   • Auth Source: Select Standard.
   • User Type: Select API User.
   • Role: Select Read Only (sufficient to list indicators).
5. Click Save.
6. An activation email is sent to the new account; complete the activation.

Generate API key

1. Sign in to the ThreatStream as the API user.
2. Go to profile avatar > My API Keys.
3. Click Generate New Key.
4. Enter a Description (for example,Google SecOps export).
5. Click Save.
6. Copy and save the key value displayed under Key in a secure location. The key value is not displayed again.

Recommended: Allowlist collector IP

1. Go to Administration > Organization Settings.
2. Select the IP Allowlist tab.
3. Click + Add.
4. Enter your Google SecOps tenant address and click Save.

Set up feeds

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Anomali TS IOC).
4. Select Third Party API as the Source type.
5. Select the Anomali log type.
6. Click Next.
7. Specify values for the following input parameters:
   • Username: Enter the newly created API user.
   • Secret: Enter the generated API Key copied earlier.
   • Asset namespace: The asset namespace.
   • Ingestion labels: The label applied to the events from this feed.
8. Click Next.
9. Review the feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.