Performing Threat Triage Using the CLI
Before you can prioritize a threat intelligence enrichment, you must ensure that the enrichment is working properly.
To perform threat triage using the CLI, you must complete the following steps:
- 1. HCP Information Roadmap
- 2. Understanding Hortonworks Cybersecurity Suite
- 3. Configuring and Customizing HCP
- Adding a New Telemetry Data Source
- Telemetry Data Source Parsers Bundled with HCP
- Prerequisites to Adding a New Telemetry Data Source
- Understanding Streaming Data into HCP
- Streaming Data Using NiFi
- Understanding Parsing a New Data Source to HCP
- Elasticsearch Type Mapping Changes
- Creating a Parser for Your New Data Source by Using the Management Module
- Transform Your New Data Source Parser Information by Using the Management Module
- Tuning Parser Storm Parmeters
- Create a Parser for Your New Data Source by Using the CLI
- Verifying That Events Are Indexed
- Enriching Telemetry Events
- Configuring Indexing
- Preparing to Configure Threat Intelligence
- Prioritizing Threat Intelligence
- Setting Up Enrichment Configurations
- Understanding Global Configuration
- Creating Global Configurations
- Understanding the Profiler
- Creating an Index Template
- Configuring the Metron Dashboard to View the New Data Source Telemetry Events
- Setting up pcap to View Your Raw Data
- Troubleshooting Parsers
- Adding a New Telemetry Data Source
- 4. Monitor and Manage
- Understanding Throughput
- Updating Properties
- Understanding ZooKeeper Configurations
- Managing Sensors
- Monitoring Sensors
- Starting and Stopping Parsers
- Starting and Stopping Enrichments
- Starting and Stopping Indexing
- Pruning Data from Elasticsearch
- Tuning Apache Solr
- Backing Up the Metron Dashboard
- Restoring Your Metron Dashboard Backup
- 5. Concepts