building-threat-intelligence-platform

构建威胁情报平台

概述

构建威胁情报平台 (TIP) 涉及部署并集成多个 CTI 工具，将其整合为一个统一系统，用于收集、分析、丰富和分发威胁情报。本技能涵盖使用开源工具（MISP、OpenCTI、TheHive、Cortex）设计 TIP 架构、配置情报源摄取管道、建立丰富化工作流、实现 STIX/TAXII 互操作性，以及为 CTI 运营构建分析师仪表板。

何时使用

• 在您的环境中部署或配置构建威胁情报平台能力时
• 在建立符合合规要求的安全控制时
• 在为该领域构建或改进安全架构时
• 在执行需要此实现的安全评估时

先决条件

• 用于部署平台组件的 Docker 和 Docker Compose
• Python 3.9+ 及 pymisp、pycti、thehive4py 库
• 用于数据存储的 Elasticsearch/OpenSearch 集群
• 用于消息队列的 Redis 和 RabbitMQ
• 了解 STIX 2.1 数据模型和 TAXII 2.1 传输
• 丰富化服务的 API 密钥（VirusTotal、Shodan、AbuseIPDB）

关键概念

TIP 架构组件

1. 收集层：从 OSINT、商业和内部来源摄取情报源
2. 存储层：使用 STIX 2.1 schema 索引 CTI 数据的 Elasticsearch/OpenSearch
3. 分析层：用于知识图谱分析的 OpenCTI 和用于 IOC 关联的 MISP
4. 丰富化层：用于自动化 IOC 丰富化的 Cortex 分析器
5. 响应层：用于案例管理和事件响应集成的 TheHive
6. 共享层：用于对外情报共享的 TAXII 服务

平台集成点

• MISP <-> OpenCTI：通过 OpenCTI MISP 连接器进行双向同步
• OpenCTI <-> TheHive：从高置信度指标创建告警/案例
• TheHive <-> Cortex：对案例可观测对象进行自动化分析和丰富化
• 全部 <-> SIEM：通过 API 或 Kafka 将 IOC 实时推送至 Splunk/Elastic

工作流

步骤 1：使用 Docker Compose 部署平台

version: '3.8'
services:
  # --- Storage Layer ---
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
    ports:
      - "9200:9200"
    volumes:
      - es-data:/usr/share/elasticsearch/data

  redis:
    image: redis:7
    ports:
      - "6379:6379"

  rabbitmq:
    image: rabbitmq:3-management
    ports:
      - "5672:5672"
      - "15672:15672"

  minio:
    image: minio/minio
    command: server /data --console-address ":9001"
    ports:
      - "9000:9000"
      - "9001:9001"

  # --- MISP ---
  misp:
    image: ghcr.io/misp/misp-docker/misp-core:latest
    ports:
      - "8443:443"
    environment:
      - [email protected]
      - MISP_BASEURL=https://localhost:8443
    volumes:
      - misp-data:/var/www/MISP/app/files

  # --- OpenCTI ---
  opencti:
    image: opencti/platform:6.4.4
    environment:
      - APP__PORT=8080
      - [email protected]
      - APP__ADMIN__PASSWORD=TIPAdminPassword
      - APP__ADMIN__TOKEN=tip-opencti-token-uuid
      - ELASTICSEARCH__URL=http://elasticsearch:9200
      - MINIO__ENDPOINT=minio
      - RABBITMQ__HOSTNAME=rabbitmq
      - REDIS__HOSTNAME=redis
    ports:
      - "8080:8080"
    depends_on:
      - elasticsearch
      - redis
      - rabbitmq
      - minio

  # --- TheHive ---
  thehive:
    image: strangebee/thehive:5.3
    environment:
      - TH_CORTEX_URL=http://cortex:9001
    ports:
      - "9000:9000"
    depends_on:
      - elasticsearch

  # --- Cortex ---
  cortex:
    image: thehiveproject/cortex:3.1.8
    ports:
      - "9001:9001"
    depends_on:
      - elasticsearch

volumes:
  es-data:
  misp-data:

步骤 2：配置情报源摄取管道

from pymisp import PyMISP
from pycti import OpenCTIApiClient
import json

class TIPFeedManager:
    """Manage threat intelligence feed ingestion across platform components."""

    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):
        self.misp = PyMISP(misp_url, misp_key, ssl=False)
        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)

    def configure_osint_feeds(self):
        """Enable default OSINT feeds in MISP."""
        osint_feeds = [
            {"name": "CIRCL OSINT", "id": 1},
            {"name": "Botvrij.eu", "id": 2},
            {"name": "abuse.ch URLhaus", "id": 5},
            {"name": "abuse.ch Feodo Tracker", "id": 6},
        ]
        for feed in osint_feeds:
            try:
                self.misp.enable_feed(feed["id"])
                self.misp.fetch_feed(feed["id"])
                print(f"[+] Enabled feed: {feed['name']}")
            except Exception as e:
                print(f"[-] Failed: {feed['name']}: {e}")

    def configure_opencti_connectors(self):
        """List and verify OpenCTI connector status."""
        connectors = self.opencti.connector.list()
        for conn in connectors:
            print(
                f"  Connector: {conn['name']} - "
                f"Active: {conn['active']} - "
                f"Type: {conn['connector_type']}"
            )

    def sync_misp_to_opencti(self):
        """Verify MISP-OpenCTI sync is operational."""
        # OpenCTI MISP connector handles this automatically
        # Check connector status
        connectors = self.opencti.connector.list()
        misp_connector = [
            c for c in connectors if "misp" in c["name"].lower()
        ]
        if misp_connector:
            print(f"[+] MISP connector active: {misp_connector[0]['active']}")
        else:
            print("[-] MISP connector not found - configure in Docker Compose")

步骤 3：使用 Cortex 构建丰富化管道

import requests

class CortexEnrichment:
    """Integrate Cortex analyzers for automated enrichment."""

    def __init__(self, cortex_url, cortex_key):
        self.url = cortex_url
        self.headers = {"Authorization": f"Bearer {cortex_key}"}

    def list_analyzers(self):
        """List available Cortex analyzers."""
        resp = requests.get(
            f"{self.url}/api/analyzer",
            headers=self.headers,
            timeout=30,
        )
        if resp.status_code == 200:
            analyzers = resp.json()
            for a in analyzers:
                print(f"  {a['name']}: {a.get('description', '')[:60]}")
            return analyzers
        return []

    def analyze_observable(self, observable_type, observable_value, analyzer_id):
        """Submit an observable for analysis."""
        job = {
            "data": observable_value,
            "dataType": observable_type,
            "tlp": 2,
            "message": "TIP automated enrichment",
        }
        resp = requests.post(
            f"{self.url}/api/analyzer/{analyzer_id}/run",
            json=job,
            headers=self.headers,
            timeout=30,
        )
        if resp.status_code == 200:
            return resp.json()
        return None

    def get_job_report(self, job_id):
        """Get the report for a completed analysis job."""
        resp = requests.get(
            f"{self.url}/api/job/{job_id}/report",
            headers=self.headers,
            timeout=60,
        )
        if resp.status_code == 200:
            return resp.json()
        return None

步骤 4：实现分析师仪表板指标

class TIPMetrics:
    """Collect platform metrics for analyst dashboards."""

    def __init__(self, misp, opencti):
        self.misp = misp
        self.opencti = opencti

    def get_platform_stats(self):
        """Collect statistics across all platform components."""
        stats = {}

        # MISP stats
        misp_stats = self.misp.get_server_statistics()
        stats["misp"] = {
            "total_events": misp_stats.get("event_count", 0),
            "total_attributes": misp_stats.get("attribute_count", 0),
            "active_feeds": len([
                f for f in self.misp.feeds()
                if f.get("Feed", {}).get("enabled")
            ]),
        }

        # OpenCTI stats via GraphQL
        stats["opencti"] = {
            "total_indicators": self.opencti.indicator.list(
                first=0, withPagination=True
            ).get("pagination", {}).get("globalCount", 0),
            "total_reports": self.opencti.report.list(
                first=0, withPagination=True
            ).get("pagination", {}).get("globalCount", 0),
        }

        return stats

验证标准

• 所有平台组件（MISP、OpenCTI、TheHive、Cortex）均已部署且可访问
• MISP-OpenCTI 双向同步可正常运行
• 至少 3 个 OSINT 情报源正在摄取数据
• Cortex 分析器已配置并返回丰富化结果
• 平台指标仪表板显示实时统计数据
• STIX/TAXII 导出功能正常，可用于情报共享

参考资料

• OpenCTI 文档
• MISP 项目
• TheHive 项目
• Cortex 文档
• MISP-OpenCTI 集成