carbonblack / cb-threatexchange-connector Goto Github PK

We will want to expand our retention period without re-requesting records from the ThreatExchange. Create a local datastore to keep those records and only request "new" ones for the past day (or other configurable time period)

I just made a change to pytx for v0.3.0 which is now on PyPi which I think breaks the threatexchange-connector.

https://github.com/carbonblack/cb-threatexchange-connector/blob/master/cbopensource/connectors/threatexchange/bridge.py#L214

You now need to call access_token.access_token() instead:

https://github.com/facebook/ThreatExchange/blob/master/pytx/pytx/access_token.py#L54

I don't know if you have a locked version of pytx which would mean you can ignore this, but I wanted to let you know just in case!

Since “0” is not the same as 0, the connector doesn't start :)

Receive the following message when trying to start the server

/etc/init.d/cb-threatexchange-connector status
cb-threatexchange-connector is stopped

There is a mismatch between the pid file created and the pid file the init script is looking for

• filtering option for sharing level to the configuration file much like the severity and status filtering options
• add sharing level to the 'group by' for reports.

Confidence level map to use:

confidence_level_map = [
    [33, "LOW"],
    [67, "MEDIUM"],
    [100, "HIGH"],
]

Produces report title:

Data provided by Threat Exchange Member 'X' with ID of 'Y'. All IOCs in this report are severity_level INFO and confidence level of MEDIUM. Confidence level MEDIUM are confidence scores between 34 and 67 on the Facebook Threat Exchange.