Admin Configure
The settings of Taranis can be configured through the Taranis web interface or via the configuration files on the Taranis server. This chapter describes the different web-based configuration options Taranis offers.
The configuration of Taranis is opened through the “Configuration” link on top of every page. This chapter will focus on these configuration items only. It depends on the user's rights which configuration options are displayed.
Figure: Configuration options
Taranis supports multiple collectors all reporting to the same Taranis database. The Collectors configuration option allows you to administer those collectors. When you want to add a new Collector to your installation, you click “Add new collector” on the top of the screen. A popup will then enable you to register this Collector based on a description.
Figure: Add a new collector
After saving the configuration Taranis will create a secret that you’ll need on the Collector side to successfully establish a connection to the Taranis server. As you will see, next to the Description the Secret will show up in the screen.
Figure: Looking up the Collector secret
“Sources” is probably the most important configuration pane as sources are the primary input for Taranis. The Collectors of Taranis scan all sources for news items. New items are inserted into the database.
Taranis supports the following types of sources:
- HTTP- and HTTPS-based sources.
- IMAP- and IMAPS-based sources.
- POP3- and POP3S-based sources.
Figure: Sources example
Taranis shows all configured sources on one page. For each source, Taranis shows the icon used for displaying messages of this source, the full URL, the category, language and status of the source, and the action icons. The first action icon (???) will open the source details screen and will delete the source. When you click on the status, the status will change into disabled. Clicking again will re-enable the source.
Taranis allows you to export and import the sources. By clicking on the button, you open the main screen through which you can import sources from a file or export sources to a CSV file.
Import Start an import by selecting an import file and then clicking on the button.
Figure: Import sources
Taranis will automatically create sources, parsers, and icons for the sources to be imported. Once completed, Taranis gives you an overview of the sources and parsers imported. It will also report problems encountered during the import.
Export When you click on the export tab, you will see the different selection options available for exporting. You can select sources based on protocol, category, language, and parser.
Figure: Export sources
The result of the export is a tarball with icons (GIF files), parser definitions (taranis.parsers.xml), and source definitions (taranis.sources.xml).
Add a new source by clicking on the button. The source details window will open in which you enter the details of the new source. The first thing you’ll have to configure is the type of source you want to add: http, https, imap, imaps, pop3 or pop3s. Depending on the type of protocol you choose, different configuration options will be shown. This paragraph describes the way in which you can add the different types of sources.
A HTTP-source can be any source that is visited over HTTP and is properly structured so that it can be parsed in a standardized way.
Figure: A HTTP-based source configuration
With every HTTP(S)-based source, you’ll have to specify the hostname, port number and URL of the source.
For instance to monitor the webpage http://edition.cnn.com/WORLD/ use the host edition.cnn.com, URL /WORLD/, and port number 80. Sometimes, a website does not run on the default HTTP-port (80/tcp) in which case you can specify an alternative port number.
Other available options:
- Parser
- Defines how you want to parse the webpage. If you’re adding an XML-based source (RSS, Atom, RDF), you can pick the default parser ‘xml’. In other cases you may have to write you own parser to be able to extract news items from a certain source.
- Source
- Defines the icon that is displayed next to all the news items that are fetched from the source. Choose an existing source icon or add a new source. When you want to add a new source, check the checkbox ‘add new source’, after which additional input fields will appear.
- Category
- Specifies in which category new items from this source will be placed The dropdown list shows all the categories currently defined. Use Configuration ‘Source categories’ to add new categories.
- Language
- Make sure you select the Language of the source if you want items of this source to be clustered.
- Collector
- Every source is bound to a specific Collector. Here you can specify which Collector instance should be used to monitor this source.
- Check ID
- If you set this value to ‘Yes’, Taranis will open the link of each new item collected and scan for CERT ID patterns in the contents of the revered page. Taranis then connect all the found IDs to the item.
- Clustering enabled
- Should new items of this source to be clustered with other items (from other sources).
- Take screenshot
- Additionally make screenshots of the pages revered to by the collected items. Users will see a screenshot and not visit this website. Use this functionality if you don’t want your users to open this website. Screenshots each take up around 1 to 3 MB of space in your database, which may add-up.
- Rating
- The rating of a source is an optional visual aid for the handler to determine how credible/important the source is. There is no difference in how the Taranis collector processes low-rated sources versus high-rated. The rating of a source is only displayed in the Assess tab under each individual item. It is for an organisation to determine what this rating represents.
- MTBC
- MTBC stands for ‘Minimum Time Between Checks’. It defines how often the source should be checked for new items, specified in minutes. When you set the ‘mtbc’ to ‘60’, the Collector will wait for a minimum of 60 minutes (1 hour) before checking the source again.
Figure: Add a new source (icon)
.png)
When you add new source you are required to specify a name and a path to an icon image. Icon images must meet the following criteria:
- The size of the image must be exactly 72x30 pixels (width x height).
- The size of the image must not exceed 5 kb.
Adding an IMAP(S)-source works almost the same as a HTTP(S)-based source. Instead of a URL you must specify a path to the mailbox on the IMAP(S)-server where Taranis should read the e-mails from. You can also specify an archive mailbox so that every e-mail processed by Taranis is automatically moved to another folder.
The figure below shows an example where Taranis is configured to read the contents of a Gmail-account over IMAPS and move read messages to the ‘Done’ folder.
Figure: Gmail as an IMAPS-source
The way you specify the mailbox, depends on the specific IMAP(S)-implementation your organization is using. To read a public or subfolder on an IMAPS-installation you might need to configure something like ‘inbox.subfolder1.subfolder2’ where all the folders in the path are separated by a dot. Click on to see whether the options you specified work with Taranis.
When you use IMAPS, you may need to use the STARTTLS command. Some IMAPS servers require this before they allow a TLS secured session.
This type of source is mostly the same as the other types of sources already discussed. Specific to the POP3(S)-sources is that you cannot specify a path, mailbox, or URL. Taranis will connect to the POP3-server you specify with the credentials you entered and then just read out your mailbox. Specify whether or not Taranis should keep a copy of the message on the server or just delete it.
Taranis supports the use of XML-advisories written by other CERT’s as a source as long as those advisories were also created with Taranis. Using the XML advisories of related CERTs as a source will enable Taranis to transfer the newly collected advisory straight to the advisory write menu.
Figure: XML advisories as source
Note that this option is only available for email based sources and not for HTTP(S)-sources. Every advisory is linked to a specific author, so you must assign an author responsible for the automatically collected advisories.
With every source you use, you can make use of word lists. Word lists allow you to reduce the number of items you collect from a specific source, based on a list of keywords. Usually, every item that is published by a source will show up as an unread item in Taranis. By using a wordlist, all items will still be inserted into the Taranis database, but onley when the item contains a keyword in your wordlist, this item will be marked as unread. In other cases, the item will automatically be marked as read so that you don’t have to assess it.
To enable a wordlist for your source, first click on the “Wordlists” tab. On this tab, you have the option to turn keyword filtering on or off use one or two wordlists. When you select one wordlist, Taranis will check whether a keyword on this list is found in the each item. If so, Taranis will mark the item as unread, otherwise as read.
Figure: Wordlists
You can also specify two wordlists. In that case, keywords from both wordlists will be combined. A new item needs a keyword match in either lists to become ‘unread’.
A possible use of this functionality is to filter on threats specific to your constituency. In this case, one wordlist lists names of your Constituents, and the other list is filled with threats. For example, the first wordlist contains the organization name ‘NCSC’ and the other list contain threats like ‘powned’, ‘attacked’, ‘XSS’, etc. In this case, only when an item describes a XSS vulnerability in the NCSC website, it will show up in your assess view.
The ‘Source Categories’ option under the main ‘Configuration’ menu allows you to administer the categories for your sources. By default, five categories are configured. Feel free to add new categories or remove default categories.
Default source categories:
- Ict-news
- ICT-related news, not necessarily security-related.
- News
- General news, e.g. websites of newspapers.
- Security-news
- Background information on developments in the ict-security area. Examples are blogs from security specialists security companies.
- Security-tweets
- Security-related tweets, e.g. twitterfeeds of security specialists and Twitter searches for security-related terms.
- Security-vuln
- Websites and feeds describing actual vulnerabilities in software, from vendors (e.g. Microsoft) and 3rd parties (e.g. SecurityFocus).
Clusters are defined per category and per language. Taranis supports clustering of items collected from sources indicated as Dutch or English. Should you require clustering of news items in different languages, add a Clustering runs after each collector run.
Figure: Cluster details
The different configuration options:
- Category
- Determines the category that the clustering settings are applied to.
- Threshold
- The threshold determines the measure of reliability with which clustering is applied. A higher value increases the reliability that clustered items are actually related. This consequently results in more and smaller clusters. Should you decide to experiment with these values, do so by beginning with value changes of 0.1 at a time.
- Timeframe
- Defines the timeframe that a cluster is kept alive. Any news items that are older than the defined timeframe will be exluded from the cluster.
- Recluster
- Reclustering is used to re-evaluate the currently formed clusters. Should specific news items belong to a different cluster or should a previously unclustered news item be deemed to be part of an existing cluster, the clusters will be re-shuffeled accordingly.
- Disabled
- Indicates wether a category/language combination is clustered or whether clustering is disabled for the the particular category/language combination.
All data collected from HTTP(S)-based sources in Taranis is parsed based on parser-definitions. Initially Taranis supports two parsers:
- the ‘xml’-parser that is valid for XML-based feeds like RSS and Atom.
- the ‘Twitter’-parser which is valid for sources that use the Twitter v1.1-API, e.g. Twitter feeds.
We found that many security teams make use of Twitter feeds and Twitter searches to get the latest developments. Before you can add Twitter sources, first configure your Twitter credentials in the main Taranis configuration file (taranis.conf.xml).
All these settings are used to access Twitter information based on Oauth. You can generate the consumer and access information from https://dev.twitter.com
- twitter_consumer_key
- twitter_consumer_secret
- twitter_access_token
- twitter_access_token_secret
NOTE: For Twitter sources to function, it is important that the time on your server is set correctly. If the time is not set correctly, this can lead to authentication problems.
In this example, monitor the mentioning of the keyword ‘mykeyword’ on Twitter. First, you add a new source, linked it to the ‘twitter’-parser and fill in the other settings.
Figure: Example Twitter source
The source is configured to connect to api.twitter.com over port 443 (https) It queries for ‘mykeyword’ with a maximum of 100 results. In the same way you can add Twitter users you want to follow.
Let’s have a look at a simplified example to explain the working of parsers. Imagine you want to monitor new messages on a website.
Figure: Example website
To write a parser for this page, you must first take a look at its HTML-code behind the website:
<html>
<head>
<title>Test website</title>
</head>
<body>
<li>
<a href="/1.html">Message 1</a><br />
Description1<br /><br />
</li>
<li>
<a href="/2.html">Message 2</a><br />
Description2<br /><br />
</li>
<li>
<a href="/3.html">Message 3</a><br />
Description3<br /><br />
</li>
</body>
</html>
Try to find out how the website is structured and especially look for strings defining the news items. In the previous example, we can see that every news item starts with <li> and is closed with </li>. We use these start- and end-tags as the basis of our parser. If we tell Taranis that it should parse this page based on these tags, Taranis will find three items on this page:
<li> <a href="/1.html">Message 1</a><br /> Description1<br /><br /> </li> <li> <a href="/2.html">Message 2</a><br /> Description2<br /><br /> </li> <li> <a href="/3.html">Message 3</a><br /> Description3<br /><br /> </li>
Now that we isolated the different news items, we must further parse these items into titles, descriptions and links. Again, we will look for strings that help us split the different items into these components. Looking at the items, we can conclude the following:
- The message title starts at
">and ends at</a>. - The message description starts at
<br />and ends at<br. - The link starts at
href="and ends at">.
Item 1 Title : Message 1 Description : Description 1 Link : /1.html Item 2 Title : Message 2 Description : Description 2 Link : /2.html Item 3 Title : Message 3 Description : Description 3 Link : /3.html
This seems to be good, except for the fact that the links are not absolute. If Taranis stores the items with these links, Taranis will not be able to redirect the user to the right page. That is why Taranis allows you to define a link prefix that will be prepended to the link that is extracted from the item. By specifying a prefix like http://www.website.com the resulting links will point to http://wwww.website.com/1.html, http://www.website.com/2.html and so on.
The example described here is simplified. However, most websites that have a news page or the like, have a structured design. It can be a little bit tricky to figure out what the best way is to parse a website, but most of the time you will succeed. If, after parsing, you end up with both valid items and invalid items, you could consider to first strip the page from unwanted content.
Let’s assume the page we are parsing is the same as the one before, but starts with the following HTML-code:
<html>
<head>
<title>Test website</title>
</head>
<body>
<ul><li><a href="#unwanted">Unwanted content</a></li></ul>
<li>
...
If we were to parse the webpage with the parser we just defined, not only would we see the messages we need, but also the ‘Unwanted content’ message at the top of the page. To prevent this, we configure to first strip of all the contents starting at <head> and ending at </ul>. This way, the unwanted content is removed before parsing. The resulting parser configuration in Taranis is:
Figure: Parser example
By using ID patterns in combination with the ‘Check ID’ feature with sources, Taranis will automatically parse all IDs with a given item. Sometimes, you will receive ‘false positives’ because a webpage shows IDs that are related to some other message. An example of such a webpage:
Figure: False positives on IDs
Above example shows a web interface for a mailing list, in this case the former ‘Full Disclosure’ list. The web interface not only shows the current message, but also references to other messages posted on the list (‘Prev by Date’ and ‘Next by Date’). If these references contain an ID, these IDs will be added to an item. If you want to prevent this, you can configure strips. By using a strip you make sure that unwanted content is stripped from an item before Taranis will search for IDs.
The figure below shows an example of a strip. You can specify a maximum of three strips per host (strip 0, strip 1 and strip 2). Each strip is a regular expression describing the contents that should be stripped off. The strip definition of figure 5-17 specifies that all content from <HTML>… to END PGP… should be stripped off in case the hostname is equal to lists.vmware.com.
Figure: Strip example
When checking items for IDs, Taranis will automatically apply all relevant strips to the page.
One of the prime goals of Taranis is to link different items, analyses, and publications with each other, based on common identifiers. When different news sources report about a vulnerability and include the same identifier in their report, it is simple to link these reports and to find-out whether or not you already created a publication for it. In order to extract identifiers from news items, you must define patterns for these identifiers first. By default, Taranis already has patterns for some of the most used identifier types like CVE-ID.
An identifier pattern is a Perl5 regular expression. Every identifier pattern has three properties: the name, the pattern, and an optional substitution. The substitution also is a regular expression that serves to substitute parts of the item in order to be able to extract identifier patterns. An example identifier pattern for Adobe security advisories:
Figure: Example ID-pattern
Click on the button to verify the regular expression(s) you enter. Every source that is visited by the Collector and has the option ‘Check ID’ set to ‘Yes’ will automatically be scanned against all identifier patterns defined.
Taranis uses the concept of Constituents. Constituents can be seen as customers of the security team. Constituent individuals are grouped into Constituent groups. Constituent groups are usually organizations within the constituency, whereas Constituent individuals are the employees of these organizations. Each Constituent group is of a specific Constituent type. The type of Constituent dictates what kind of products this Constituent group is allowed to receive.
The rest of this chapter will go into detail on the different aspects surrounding Constituents.
Users can define different Constituent types through the ‘Constituent Types’ option in the Configuration menu. Enter a name for a Constituent type and assign publication types to it. As described in further down in this chapter, linking publication types to a Constituent type will have a great impact on the publication types that Constituent individuals will be able to receive.
NOTE: Taranis will warn you when you unlink a publication type from a Constituent type because this will break all links between Constituent individuals and publication types for all Constituent groups that are assigned to this specific Constituent type.
Each Constituent individual has a role. This role describes the type of contact person this individual is to your organization. Examples of this role are: “operational contact” or “contract owner”. You can configure the Constituent role in the Constituent Roles configuration item. Each entry in this configuration item contains only one value. The possible values are given as the Role options in the Constituent individual information screen.
You can manage the Constituent groups by choosing ‘Constituent groups’ from the Configuration menu. The figure below shows the information displayed for Constituent groups.
Figure: Management of Constituent groups
If you have a lot of Constituent groups configured, you can search through them based on Constituent type, keyword or status. For every Constituent group, the name of this group is shown. To the right of the Constituent group, a maximum of four action icons is displayed. The user can edit the Constituent group by clicking on the icon. The icon will give you an overview of this specific Constituent group, including Constituent individuals that are linked to this Constituent group. Clicking the icon will delete the specific Constituent group.
The icon does not have any action configured with it, but is simply an indicator that this Constituent group will have to be called in case of a high/high advisory.
When you edit a Constituent group or add a new Constituent group (by clicking on the button), the details window for Constituent groups is opened. This window has four tabs to manage the different properties of a Constituent group.
General settings The ‘General settings’ tab allows you to administer general properties of the Constituent group. An example of these properties:
Figure: Constituent group properties
Many of the properties are pretty straight forward: you can edit the name, the type, and the current status of the Constituent group. The list of Constituent types available is based on the list of types you configured. The configured Constituent type defines what kind of publications the members of this group will be allowed to receive.
You must also indicate whether or not to use the software/hardware list (‘Software/Hardware list in use’) of this Constituent group. If you choose ‘Yes’, this Constituent group will only receive those advisories that are linked to hardware and software that are on the software/hardware list of this Constituent group. If you choose ‘No’, the software/hardware list will be ignored, which results in the Constituent group receiving all advisories.
The ‘Call for H/H incident’ property indicates whether or not the Constituent group wishes to be called in case of an advisory that has high chance and high impact. If you choose ‘Yes’, the Constituent group will automatically be added to the calling list of such an advisory.
Configuring Constituent group members The ‘Members’ tab allows users to link Constituent individuals to Constituent groups. On the right side of this tab, a list of all configured Constituent individuals is displayed. By selecting one or more Constituent individuals and then clicking the button, Taranis will link the individuals to the group. You can select more Constituent individuals at once by holding down the [Ctrl]-key while selecting or double clicking on a specific Constituent individual to only select that individual. Please note that it is possible to add a Constituent individual to multiple groups.
Populating the software/hardware list Taranis supports the use of CPE to populate a list of possible hard- and software in use by Constituent groups. The ‘Software/Hardware’ tab enables users to link hard- and software from this list to a Constituent group. By linking hard- and software to Constituent groups it is possible to only send relevant advisories to this Constituent group.
You can link hard- and software by searching through the soft-/hardware list and then selecting all relevant items. Again, clicking the button (or double clicking on an item) will link the selected hard- and software to the group.
Figure: Populating the hard-/software list of a Constituent group
Notes You can add notes to a Constituent group. These notes enable users to record unstructured information about the Constituent. The notes show in a high/high caller list so that any particulars about the Constituent group is automatically presented to the person responsible for informing this group.
As described in the previous paragraph, Constituent individuals are part of a Constituent group. Constituent individuals can be managed by selecting the ‘Constituent individuals’ option from the Configuration menu.
Figure: Management of Constituent individuals
The action icons for each Constituent individual works basically the same as for the Constituent groups described in the previous paragraph: the user can edit the Constituent individual by clicking on the icon and delete the Constituent individual by clicking on the icon. The icon is again an indicator that this Constituent individual will have to be called in case of a high/high advisory. Hovering your mouse pointer over the icon allows you to quickly see the main information about this individual.
When you edit a Constituent individual or create a new one, Taranis will open the Constituent individual details window. Split across three tabs, this window allows the user to specify individual properties, link the individual to Constituent groups, and specify the publication types the individual wishes to receive.
Individual details The ‘Individual details’ tab enables the user to record contact information for this individual (e-mail, phone) and the role of the user. Regarding the preferences for contact over the phone in case of high/high advisories, the user cannot only specify whether the individual wants to be called, but also if he wants to be called outside office hours. Taranis will use these settings when it creates a calling list for a specific high/high advisory.
Constituent role Each individual has a role. This role describes the type of contact this individual is to your organization. Examples of this role are: “operational contact” or “contract owner”. You can configure the Constituent role in the Constituent Roles configuration. Each entry in this configuration contains only one value. The possible values are given as the Role options in the Constituent individual information screen.
Specifying publication types You can define which publication types a user wishes to receive. The publication types available depend on the Constituent group(s) the individual is a member of, the type of these Constituent group(s) and the publication types linked to these Constituent types.
Figure: Publication types for an individual
Taranis currently supports the following publication types:
- Advisory (email)
- an email with the advisory text, without an XML-based version of the advisory attached to it.
- Advisory (XML)
- an email with the advisory text, with an XML-based version of the advisory attached to it. Based on the “advisory (email)”.
- Advisory (forward)
- a separate advisory product, which consists of a “raw” original (vendor) advisory along with added metadata.
- End-of-Shift (email)
- an email with the end-of-shift.
- End-of-Week (email)
- an email with the end-of-week.
The list of hard- and software in use by constituents is called the ‘photo’. This is a historic term used by NCSC-NL that might lead to some confusion. It refers to the ‘snapshot’ of used hard- and software by a constituent.
You can import and export these lists through the Taranis web interface.
Import photo Change a list of software and hardware used by a constituent via the Taranis GUI based by uploading a CSV file. Taranis will link all the soft- and hardware in that file to the constituent you specify.
The CSV file you specify must contain all the soft- and hardware you want to import, one component per line. Each component must be defined as producer, soft-/hardware name, soft-/hardware type and CPE-ID, divided by colons, for example:
"3Com","Router 5231","cpe:/h:3com:3c13750","Hardware"You start the import-process by clicking the button in the Photo management-section. Next, the ‘Import photo’ screen will open. This screen allows you to import a photo and get an overview of all the previous imports.
Figure: Import photo
The list of imports shows the Constituent group for which a photo was imported, the time the import was created and the time the import was finalized (‘imported on’). For all pending imports (imports that still have issues), the ‘imported on’ property is empty. You can open such an import by clicking on the Constituent group name.
You start an import by selecting a Constituent group from the dropdown list and browsing for a CSV file. All Constituent groups, for which an import is pending, will not show up in the dropdown list. This is to prevent concurrency issues.
Once you have selected a Constituent group and a CSV file, click on the button to start the import. If the CSV is properly structured, you get an overview of the items to be imported as follows:
Figure: Items to be imported
Different colors indicate whether attention is needed before the import of the item can be executed. Items are colored white, green, light orange or dark orange.
White indicates that the item is already on the Constituents photo. Green indicates that the item can be linked to the Constituent group with no extra attention. Orange indicates that the user must consider creating an issue for this item and red indicates that the item cannot be linked to the Constituent group because the hard-/software could not be found.
Depending on the status (color) of the item, you can perform different actions:
- Accept the import of the item. The item will be linked to the Constituent group.
- Create an issue for this item. An issue means that further action needs to be taken before this item can be linked to the Constituent group. Possible actions include: finding a source to be able to monitor vulnerabilities in this product, or creating a new soft- or hardware item in case the item is not part of the current soft-/hardware list.
- Remove the item from the import-list. The item will not be linked to the Constituent group and an issue will be created.
| CPE-match | Exact match | In use | |
|---|---|---|---|
| Yes | Yes | Yes | Taranis found a match on both CPE-ID and name. This product is already in use by another Constituent so it is safe to link this item |
| Yes | Yes | No | Although Taranis found a match on both CPE-ID and name, attention is required because this product isn’t used by any of the other Constituents. |
| Yes | No | Yes | Taranis found a match based on CPE-ID and the product is already in use. We can link it without intervention. |
| Yes | No | No | Taranis found a match based on CPE-ID but the product is not in use by any of the other Constituents. |
| No | Yes | Yes | Taranis found a match (based on name) and this product is in use by at least one of the other Constituents. It is safe to link without intervention. |
| No | Yes | No | Taranis found a match (based on name) but this product is not yet in use by any of the other Constituents. |
| No | No | Yes | This situation cannot occur: a product that is in use but is not listed in the soft-/hardware list. |
| No | No | No | The product is not known by Taranis. You must first add a new item to the soft-/hardware list before you can import this item. |
Every import will most probably result in issues that need to be resolved before the list can be linked to the Constituent group. The list of all open issues can be seen by just opening Photo management again. All open issues are indicated with a red background:
Figure: Open issues
You must resolve all open issues before you can actually import the photo of the Constituent. If no match was found for a particular software item you must first add a new item to the hard-/software list, and then reopen the issue. You can then link the issue to the new soft-/hardware item just created and then resolve the issue as illustrated in
Figure: Resolve issue
Taranis remembers the choices you make. This means that an item you resolve will automatically be resolved in future imports when the same item shows up in this import.
Special attention is required if you add an item to a photo that is not yet in use by any of the other Constituents. In this case you must make sure that you have proper sources in Taranis to monitor for new vulnerabilities in that product. You must resolve these issues by following a workflow that mostly resembles the workflow of publications: add your comments, set the issue to Ready for review, and Accept & resolve the issue.
Figure: Accept and resolve issue
Export empty photo You can export the list of soft- and hardware by clicking from within Photo management. This will present you with a comma separated file that lists the following information of all soft- and hardware:
- Producer (vendor), e.g. ‘Oracle’.
- Product, e.g. ‘PeopleSoft Enterprise’.
- CPE-ID (if applicable), e.g. ‘cpe:/a:oracle:peoplesoft_enterprise’.
- Soft-/hardware type, e.g. ‘Application.
You can send the soft-/hardware list to your constituents so that they can specify which products they use. The Constituent must then create a new CSV file in which only the products they use are listed. This file can then be imported through the ‘Photo import’ functionality (see previous section).
Export all products in use The button results in a CSV file, just like the CSV file described in the previous section. The only difference is that only soft- and hardware items that are in use by any of your Constituents will be placed in this file.
Export all photos You can all the photos of your constituents. You can use this list e.g. as a backup in case Taranis is not available. The output is again a CSV-file just as with the empty photo. The only difference is that an extra column (“Constituent”) is added to the list.
After installation of Taranis only the ‘admin’ user is defined. To add a new user or edit the properties of an existing user, open the users’ details window. It will show some basic properties of the user (figure 5-30). You can specify the full name, email address. and email name of this user.
The “Role” tab allows the administrator to specify which roles the users will have.
Figure: User configuration
By default only the role ‘Taranis Administrator’ is available, which allows full access to the configuration. You may link multiple roles to a single user; to do this, the access rights the user will receive are cumulative (the rights of all the roles combined).
The “Change password” tab allows the administrator to change the current password of the users. The “Actions” tab gives you an overview of the last actions by this user.
Taranis supports a granular authorization framework in which users can get access to the different features of Taranis. This authorization framework makes use of “roles”, “entitlements”, and “particularizations”. An entitlement defines the authorization a user can have on a very specific component of Taranis, e.g. authorizations to access the “Assess”-part of Taranis.
A role is used to group a list of entitlements and to specify the exact rights on this entitlement. Possible rights on an entitlement are “Read” (R), “Write” (W) and “Execute (X). When a user has for example only Read-access to items he or she can read the items collected but cannot change the status of these items.
| admin_generic | Defines access to generic administration features |
| analysis | Analyses |
| configuration_generic | Item categories, collector logs, ID patterns |
| configuration_parser | Parser definitions |
| configuration_strips | <currently not in use> |
| Constituent_groups | Constituent groups, soft-/hardware linked to Constituent groups |
| Constituent_individuals | Constituent individuals, Constituent roles |
| cve | CVE Descriptions |
| damage_description | Damage descriptions |
| entitlements | <currently not in use> |
| dossiers | The dossier functionality |
| generic | Basic access (required for every user) |
| item_analysis | Items from assessment to analyze, bulk analysis, multiple analyses |
| items | Items |
| membership | <currently not in use> |
| photo_import | Photo management features under Configuration |
| publication | Publications, soft-/hardware list, publishing, calling lists |
| publication_template | Publication templates |
| publication_type | <currently not in use> |
| report | Report functionality |
| rest_level_1-4 | Access to the REST API |
| role_right | Roles, role rights |
| roles | Roles, role rights |
| soft_hard_usage | <currently not in use> |
| software_hardware | Soft-/hardware types, soft-/hardware list |
| sources_errors | <currently not in use> |
| sources_items | Sources, strips |
| sources_stats | Statistics |
| tools | Tools |
| user_action | User actions |
| user_role | User roles, users |
| users | Users |
The ‘Rights’ tab for a role shows all the entitlements along with three checkboxes (R, W, X) and sometimes a particularization.
Figure: Role rights
Some entitlements support a particularization. These particularizations enable the administrator to further limit the access of the user to certain subsets of the entitlement. The example shows that the role has read-, write- and execute-access to analyses, but only for analyses with the statuses ‘Done’, ‘Eow’, ‘Eow Done’ and ‘Pending’. This means that the user does not have access to analyses with another status than those.
Publication templates ease the process of advisory creation. You can create templates for texts that you often use in your publications. Taranis comes with several publication templates: ‘Advisory (email)’, ‘Advisory (update)’, ‘Advisory (forward), ‘Advisory (forward update)’, ‘End-of-Shift (email)’, and ‘End-of-Week (email)’. You can change these templates to adapt the standard NCSC-NL products for your own use.
The strength of templates lies in the fact that you can easily create publications thereby avoiding errors and using uniform texts. To enable flexibility in your templates, you can use variables in your texts.
When describing vulnerabilities and solutions, for example, you will regularly see updates from the same vendor. The texts you use to describe these solutions are often the same. To ease this process you decide to create a template to describe an update from Ubuntu. The text you use for Ubuntu-updates is something like this:
Ubuntu released updates for Ubuntu 12.04 LTS to resolve this issue. You can install these updates by using 'apt-get update' and 'apt-get upgrade'. More information about the vulnerability can be found here: http://www.ubuntu.com/usn/USN-1439-1
You can create a template for the text shown above by choosing “Publication Templates” from the main configuration screen and then clicking ???. The window that will open, allows you to specify some general properties of the template you’re about to create.
Figure: New publication template
Make sure the title properly describes the contents of your template, as this is the name you will see when loading templates into your advisory or other publications. Also, specify in which product you want to normally use your template.
The ‘Template’-tab contains the actual template, formatted as XML. Taranis fills in the following XML in this tab:
<publication>
<template>
</template>
<fields>
</fields>
</publication>The template-text must be placed in the <template> container. Variables to be used in the text must be placed in the <fields> container.
If we use the example text for Ubuntu and replace the dynamic parts with variables, the text could look something like this:
Ubuntu released updates for Ubuntu _fld_ubuntuversion_ to resolve this issue. You can install these updates by using 'apt-get update' and 'apt-get upgrade'. More information about the vulnerability can be found here: http://www.ubuntu.com/usn/USN-_fld_ID_
Variables in the text must be enclosed by underscores ('_'). The first variable in the text is the Ubuntu versions that are updated which we will call variable _fld_ubuntuversion_. The second variable is the ID of the Ubuntu advisory-ID which we will call variable _fld_ID_.
Now that we defined these two variables, we will have to tell Taranis what kind of variables these are. Taranis supports the following input types for variables:
- Text area;
- Textbox;
- Dropdown list;
- Radio buttons;
- Checkboxes.
<fields> container. For the Ubuntu version we want to show a list of supported versions that can be checked by the user:
<fld_ubuntuversion desc="Ubuntu version(s)"> multiple:10.04 LTS:11.10:12.04 LTS </fld_ubuntuversion>
Each variable must be represented as an XML-tag. The description for the variable is stored in the desc-attribute. Between the variable tags, the user can specify the type of input field (textarea, text, dropdown, radio or multiple). Properties for the input field are placed behind the type-indicator, divided by colons.
Example Result:
-
textarea:10:20Shows a text area with 10 columns and 20 rows. -
text:10Shows a textbox with size 10. -
dropdown:a:b:cShows a dropdown list with values ‘a’, ‘b’ and ‘c’. -
radio:a:b:cShows three radio buttons with values ‘a’, ‘b’ and ‘c’. -
multiple:a:b:cShows three checkboxes with values ‘a’, ‘b’ and ‘c’.
<publication>
<template>
Ubuntu released updates for Ubuntu _fld_ubuntuversion_ to resolve this issue. You can install these updates by using 'apt-get update' and 'apt-get upgrade'. More information about the vulnerability can be found here:
http://www.ubuntu.com/usn/USN-_fld_ID_
</template>
<fields>
<fld_ubuntuversion desc="Ubuntu version(s)">
multiple:8.04 LTS:10.04 LTS:11.10:12.04 LTS:12.10
</fld_ubuntuversion>
<fld_ID desc="Ubuntu-ID (USN-XXX-X):">text:170</fld_id>
</fields>
</publication>After you’ve entered the template, press the button to find out if your XML is syntactically correct. If validation of the template was successful, you can save it and use it in your publications. The figure below shows how the Ubuntu-template can be used in an advisory.
Figure: Using templates
To standardize the damage descriptions for advisories, Taranis enables you to administer a standard list of damage descriptions to include in your advisory. Open the list of damage descriptions through “Damage description” on the “Publication configuration” pane.
Examples of damage description that NCSC-NL uses in its advisories are ‘Remote code execution’ and ‘Denial of Service’. All the damage descriptions you add to this list, will automatically be loaded into the advisory.
Figure: a list of possible damage descriptions loaded in an advisory
Taranis keeps a list of all soft- and hardware. This list is used to indicate vulnerable software in an advisory. By linking Constituent groups to soft- and hardware, it is possible to automatically send an advisory only to Constituent groups that use that vulnerable soft- or hardware. You can manually add new items to the list or use the CPE list maintained by MITRE.
Below an example of the soft-/hardware list. For each piece of soft-/hardware, Taranis shows an icon that indicates the use of the soft-/hardware within the constituency. This can help in deciding to write an advisory or skip it because the soft-/hardware is not in use.
Figure: The soft-/hardware list
When a particular piece of soft-/hardware is in use (see the ‘in use indicator’), you can move your mouse pointer over the indicator to see which organizations use this soft-/hardware. An administrator can open the details of the soft-/hardware by clicking on the ???-icon next to it.
You can add new hard- or software to the list by clicking on the button at the top of the page. This will open up a pop-up like:
Figure: Add new hard- or software
Specify the name of the producer (vendor), the name of the product, and optionally a version number of the soft- or hardware. CPE ID is only used with soft- and hardware imported from the CPE-list. The type indicates what you want to add to the list:
- Hardware;
- Operating System; or
- Software.
Keeping the list of soft- and hardware up-to-date can be a daunting task. To ease the maintenance of this list, Taranis supports the use of the Common Platform Enumeration (CPE) list maintained by MITRE. According to MITRE:
“CPE is a structured naming scheme for information technology systems, platforms, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a language for describing complex platforms, a method for checking names against a system, and a description format for binding text and tests to a name.”
You can import the latest CPE-dictionary by clicking on the button on top of the screen. Clicking on this button will open up this screen:
Figure: Import CPE dictionary
MITRE offers the CPE dictionary in the form of an XML file that is regularly updated. You can import this file directly by specifying the URL or you can enter a full path to the file on the server.
The CPE dictionary contains a lot of items. You can limit the number of items imported in Taranis by selecting the ‘Don’t import items with version’ option. Whether this is suitable for your situation mainly depends on the way your constituents specify the hard- and software they use. If they just specify the products without version numbers, you can use this filter without problems.
Click on ‘load file’ to start the import. This process is RAM intensive, so make sure you comply with the minimum system requirements.
Figure: Download and processing
After Taranis successfully processed the dictionary, it will show:
Figure: CPE-import
Taranis presents you a list of all new and changed items from the CPE-list. All new items are flagged with ???.
The figure below shows an example of a CPE-item where the product name name in Taranis (‘Integrated Runtime’) is different from the product name in the CPE (‘Integrated Runtime (AIR)’).
Figure: Changed CPE-item
It is up to you to decide how you want to process the information from the CPE. The easiest way to make your choice is by clicking on the words on the bottom of the page:
Figure: Actions on CPE-items
By clicking on the words you can define the actions to be taken on which pieces of information:
- What you want to do: import or discard.
- Which items it concerns: all new, all changed or all selected.
After you finished the complete list, Taranis may ask you if you want to import items that are only listed with a version number. This will happen if you selected the ‘Don’t import items with version’ option at the start of the import. The reason Taranis asks you this question, is because there are apparently products listed in the CPE that are only listed with a version number and not without. If you would ignore these items, you would end up with an incomplete list of hard- and software. What Taranis can do in this situation is to create a new soft- or hardware item based on the information in the CPE but without a version-number. Because this item is not listed in the CPE, it will not receive a CPE-ID. If you want to do this, click on the ???-button. If not, choose the ???-button.
Figure: Remaining CPE-items after the import
All the records in the soft-/hardware list are linked to a soft-/hardware type. Taranis needs to know what type a specific piece of hard- or software is, in order to be able to distinguish operating systems from applications running on top of that. This is especially important for advisories as these publications have different sections for the selection of vulnerable operating systems and vulnerable applications.
Based on the CPE-list, Taranis distinguishes the following software and hardware types by default:
- Application;
- Hardware; or
- Operating System.
Figure: Creating a custom soft-/hardware type
The “Other configuration” pane is used to configure settings that do not fit under one of the other categories. Currently, the tools configuration, access tokens, CVE Descriptions and CVE Templates are part of this pane.
The tools configuration pane enables you to administer the tools visible under de “Tools” menu on the frontpage.
Plugging in existing tools You can plug different tools into Taranis. By default, Taranis comes with four different tools: ‘WHOIS’, ‘Phishing Checker’, ‘Big Screen’ and ‘Feed Digest’. Every tool you define has three properties:
- Name;
- Webscript; and
- Back-end script.
The figure below shows the configuration of the phishing checker that has both a front-end and back-end: the front-end shows the status of all phishing websites, the back-end checks the current status of those websites.
Figure: tool configuration
Create your own tool You can easily add your own tools to Taranis. All you need is some creativity, some Perl knowledge, and the information provided in this paragraph. As an example we create a tool called the “Hello World” tool which will only display the message “Hello World”. In order to create this tool, you first create this very simplistic helloworld.pl script:
#!/usr/bin/perl
my @EXPORT_OK = qw(displayHelloWorld);
sub helloworld_export {
return @EXPOERT_OK;
}
sub displayHelloWorld {
my $htmlContent = "<h1>Hello world!</h1>";
return { content => $htmlContent };
}
1;
The following things are important in creating this script:
- It must contain an
@EXPORT_OKarray defining the subs that you want to be accessible through the web interface. - It must contain an
_export-sub that returns this@EXPORT_OKarray. The name of this sub corresponds with your tool name followed by the_exportstring (e.g.helloworld_export). - The subs specified in the
@EXPORT_OKarray must be part of the same file.
<entitlement id="helloworld">
<menuitem>1</menuitem>
<use_entitlement>tools</use_entitlement>
</entitlement>Make sure that the ID of your entitlement matches the name of your script (without the .pl extension).
Place your helloworld.pl in a subdirectory of the mod_tools-directory of Taranis. The directory name and the script name should correspond. In this case you create the directory scripts/mod_tools/helloworld/ and copy the script helloworld.pl to this newly created directory.
Your tool is now almost ready to use. Make sure that the permissions and ownership of your new tool are set correctly. On Ubuntu you should e.g. issue the following commands:
cd /opt/Taranis/mod_tools/ chown -R apache: ./helloworld/ chmod -R 755 ./helloworld/
Now add your tool definition by following the steps outlined in the previous paragraph. Use the settings as shown below:
Figure: Tool details
The last step is to restart or reload your Apache daemon and login to Taranis for all changes to take effect. If all went well, you should now see your tool listed in the Tools menu. Of course, the example shown is very simple but it should help you get up and running with the tools functionality. You could check the other tools scripts included with Taranis to see what other functionalities are offered by this functionality. You can make use of all core Taranis components which should enable you to easily integrate your extension into Taranis!
Access Tokens are used to grant users access to the REST API of Taranis. Use the ‘Add new tokens’ to add them. Select a user and an expire time.
CVE descriptions can be used to translate or describe a CVE once and then use it in multiple advisories. The original descriptions are provided by MITRE. The URL from which these descriptions are downloaded can be managed with the ???-button. This will show the page shown here:
Figure: Manage CVE download files
Use the add URL link to add additional URL’s. The descriptions are downloaded and processed with taranis cve descriptions.
CVE descriptions can be very similar for vulnerabilities that are related to each other. In such a case you can use a CVE Template. A new template can be added with the ???-button.
