Skip to main content

Cyware Threat Intelligence eXchange

Volon (Deprecated)

Volon integration with CTIX helps analysts to fetch malware, bin, SSH attack, SIP attack, APT, Bruteforce Telnet, anonymizers, Elastic search attack, spam, web spam, web attack, phishing, compromised IP, ransomware, CnC, DDoS, Botnet infection, and email breach feeds.

This integration helps add contextual information to seemingly isolated threat data, gives you visibility into the digital attack surface, and makes threat investigations easier. You could also gain insights into attackers, their tools and systems, and indicators of compromise.

About Volon

Volon provides adversary-centric actionable cyber threat intelligence to help threat intelligence teams in advanced threat detection and planning effective breach response.

Configure Volon App in CTIX

Volon is available as an out-of-the-box integration in the CTIX application.

Before you Start

You must have the URL, username, and password of your Volon account. The user configuring the integration should have View & Update Tool Integration permission.

Steps

Use the following steps to configure the app in CTIX:

  1. From Administration, open Integration Management and select APIs under FEED SOURCES.

  2. Click Add API source.

  3. Use the search bar to locate VOLON and click on the app.

  4. Click Add Instance to add a Volon instance.

  5. Enter the Instance name, Base URL, and API key.

    Note

    Use https://api.threat-feeds.com/dev/ as the base URL.

  6. To encrypt the connection between CTIX and Volon server, select Verify SSL.

  7. Click Save.

Configure Feed Channels for the Volon Integration

You can configure Volon feed channels using the following steps:

  1. From Administration, open Integration Management, and select APIs under FEED SOURCES.

  2. Use the search bar to locate VOLON and click on the app to open the configuration page.

  3. Click the ellipses on the top right corner and select Manage.

  4. On the Manage Instance page, click Manage Feed Channels.

  5. Select the Feed Channel to add.

  6. Enable the Feed Channel and enter the last polled date.

  7. Enter the name of the collection into which the feed data will go. The system creates this collection and put all the feeds collected from this Feed Channel into this collection.

  8. Select from one of the following Polling Cron Schedule types to poll the data:

    • Manual - Allows you to manually poll from the source collection.

    • Auto - Allows you to automatically poll for threat intel from sources at specific time intervals. Enter a frequency in seconds greater than or equal to 600 in the Polling Time field.

  9. Select a default TLP that you want to assign for the feeds.

  10. Set a default confidence score for the feeds received from this integration.

  11. Select any tags to associate with the feeds received from this integration.

  12. Enable Broken connection Retry Policy to allow the CTIX application to re-attempt any failed connection attempts to your Volon account. The system will attempt to connect 10 times.

    1. You can enter the retry interval units in minutes, days, or weeks and also specify the retry interval and the retry count.

    2. Enable Exponential Backoff Entry to progressively extend the wait time between retries for consecutive error responses.

      For example, for a 10-minute exponential retry interval, the system will re-attempt to connect in 10, 100, 1000, 10000, and so on till the retry count is met. Use this option to give your system resources some breathing time and resolve any service overload issues.

      Note

      You must have View/UpdateTool Integrations permissions to receive failed connection notifications.

  13. Click Save. 

You can configure multiple instances of this integration by clicking Manage and Add More on the Manage Instance screen.

Poll for Feeds Manually

If you enable Auto Polling while configuring feed channels, the polling will be done automatically. However, if you want to poll for information manually, use the following process:

  1. From Administration, open Integration Management and select APIs under FEED SOURCES.

  2. Select Volon.

  3. Select the feed channel.

  4. Click the vertical ellipsis and select Poll Now.

    Note

    You can poll data only from the enabled feeds.

View Feeds on the CTIX Application

After configuring the Volon integration on the CTIX application, view the intel received on the CTIX application.

  1. On the Volon integration configuration page, select View Intel.

  2. View the IOCs received in the feeds from this source in Threat Data. Some IOCs received in the feeds can not be mapped to the STIX domain objects and are mapped to the STIX custom objects.