From 4edd7295965d76f668cf520087ef3c6ed20cc4e1 Mon Sep 17 00:00:00 2001 From: weslambert Date: Wed, 27 Apr 2022 08:58:34 -0400 Subject: [PATCH] Add initial supported observable matrix/table --- salt/sensoroni/files/analyzers/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/salt/sensoroni/files/analyzers/README.md b/salt/sensoroni/files/analyzers/README.md index 1eb655824..83c4cfb77 100644 --- a/salt/sensoroni/files/analyzers/README.md +++ b/salt/sensoroni/files/analyzers/README.md @@ -2,6 +2,18 @@ Security Onion provides a means for performing data analysis on varying inputs. This data can be any data of interest sourced from event logs. Examples include hostnames, IP addresses, file hashes, URLs, etc. The analysis is conducted by one or more analyzers that understand that type of input. Analyzers come with the default installation of Security Onion. However, it is also possible to add additional analyzers to extend the analysis across additional areas or data types. +## Supported Observable Types +The built-in analyzers support the following observable types: + +| Name | Domain | Hash | IP | JA3 | URL | +| ------------------------|--------|-------|-------|-------|-------| +| Alienvault OTX |✓ |✓|✓|✗|✓| +| Greynoise |✗ |✗|✓|✗|✗| +| JA3er |✗ |✗|✗|✓|✗| +| LocalFile |✓ |✓|✓|✓|✓| +| Spamhaus |✗ |✗|✓|✗|✗| +| Urlhaus |✗ |✗|✗|✗|✓| +| Virustotal |✓ |✓|✓|✗|✓| ## Developer Guide