IntSights Report

IntSights Threat Command is a commercial Threat Intelligence platform that monitors both the open and dark web to identify threats for the Assets you care about (Domain Names, IP addresses, Brand Names, etc.).

Manual Import

Use the Export CSV feature in the IntSights Threat Command GUI to create an IntSights Alerts.csv file. This CSV file can then be imported into Defect Dojo.

Automated Import

The IntSights get-complete-alert API only returns details for a single alert. To automate the process, individually fetch details for each alert and append to a list. The list is then saved as the value for the key “Alerts”. This JSON object can then be imported into Defect Dojo.

Example:

{
   "Alerts":[
      {
         "_id":"5c80egf83b4a3900078b6be6",
         "Details":{
            "Source":{
               "URL":"https://www.htbridge.com/websec/?id=ABCDEF",
               "Date":"2018-03-08T00:01:02.622Z",
               "Type":"Other",
               "NetworkType":"ClearWeb"
            },
           "Images":[
              "5c80egf833963a40007e01e8d",
              "5c80egf833b4a3900078b6bea",
              "5c80egf834626bd0007bd64db"
           ],
           "Title":"HTTP headers weakness in example.com web server",
           "Tags":[],
           "Type":"ExploitableData",
           "Severity":"Critical",
           "SubType":"VulnerabilityInTechnologyInUse",
           "Description":"X-XSS-PROTECTION and CONTENT-SECURITY-POLICY headers were not sent by the server, which makes it vulnerable for various attack vectors"
        },
        "Assignees":[
           "5c3c8f99903dfd0006ge5e61"
        ],
        "FoundDate":"2018-03-08T00:01:02.622Z",
        "Assets":[
           {
              "Type":"Domains",
              "Value":"example.com"
           }
        ],
        "TakedownStatus":"NotSent",
        "IsFlagged":false,
        "UpdateDate":"2018-03-08T00:01:02.622Z",
        "RelatedIocs":[],
        "RelatedThreatIDs":[],
        "Closed":{
           "IsClosed":false
        }
     }
  ]
}

Sample Scan Data

Sample IntSights Report scans can be found here.