Parsing STIX Threat Intelligence file into Carbon Black Cloud

You can parse a file with the connector with the process-file command.

Example:

$ cbc-threat-intel process-file --help
Usage: cbc-threat-intel process-file [OPTIONS] [STIX_FILE_PATH] [FEED_ID]

  Process and import a single STIX content file into CBC `Accepts *.json (STIX
  2.1/2.0) / *.xml (1.x)`

  Example usage:

      cbc-threat-intel process-file ./stix_content.xml 55IOVthAZgmQHgr8eRF9rA

      cbc-threat-intel process-file ./stix_content.xml 55IOVthAZgmQHgr8eRF9rA
      -s 5

      cbc-threat-intel process-file ./stix_content.xml 55IOVthAZgmQHgr8eRF9rA
      -c default

Arguments:
  [STIX_FILE_PATH]  The location of the STIX Content file.
  [FEED_ID]         The id of the feed

Options:
  -s, --severity INTEGER  The severity of the generated Reports  [default: 5]
  -r, --replace           Replacing the existing Reports in the Feed, if false
                          it will append the results
  -c, --cbc-profile TEXT  The CBC Profile set in the CBC Credentials
                          [default: default]
  --help                  Show this message and exit.

The connector will automatically determine the STIX version and use its appropriate parsers. You must pass the file and the required parameters.

Note: You can also use json files.

Table 1. Default Values for the process-file Command

Option or Argument	Default	Description
STIX_FILE_PATH	String, Required	The location of the STIX Content file
FEED_ID	String, Required	The ID of the feed
--severity (-s)	Integer (5)	The severity of the generated Reports [default: 5]
--replace (-r)	Boolean (False)	Replacing the existing Reports in the Feed. If false, it will append the results
--cbc-profile (-c)	String (“default”)	The Carbon Black Cloud Profile set in the Carbon Black Cloud Credentials