Skip to content

[BeaconBeagle] Connector Add#6155

Open
Ch-Philou wants to merge 2 commits intoOpenCTI-Platform:masterfrom
Ch-Philou:master
Open

[BeaconBeagle] Connector Add#6155
Ch-Philou wants to merge 2 commits intoOpenCTI-Platform:masterfrom
Ch-Philou:master

Conversation

@Ch-Philou
Copy link
Copy Markdown
Contributor

@Ch-Philou Ch-Philou commented Apr 3, 2026

Hello,

this connector import data gracefully given freely at https://beaconbeagle.com/
It's "just" CobaltStrike C2 information decoded.

The connector add:

  • C2 IPs (v4 and v6) -> create indicators
  • if given DomainNames -> create indicators
  • URL -> create indicators
  • Cobalstrike licence watermark (if requested in parameters)
  • Spawned Process (if requested in parameters)
  • CobalStrike Software (with version)
  • UserAgent (stix2 lib does weird thing with this IoC type... but i got a trick)

Of course it link all this elements with associated Attack Pattern, Tool (given in parameter) and add tags

Optionally, it will make a whois for BGP (whois -h bgp.tools -v {ip_to_check}) to associate C2 IP with:

  • Country
  • BGP AS (Number and name)

It's obvious but: it works on my OCTI :)

Fixes #6156 6156

@Ch-Philou Ch-Philou changed the title BeaconBeagle Connector [BeaconBeagle] Connector Add Apr 3, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 3, 2026

Codecov Report

❌ Patch coverage is 0% with 590 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.09%. Comparing base (ae8c271) to head (16b22fc).
⚠️ Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
external-import/beaconbeagle/src/BeaconBeagle.py 0.00% 590 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (ae8c271) and HEAD (16b22fc). Click for more details.

HEAD has 90 uploads less than BASE
Flag BASE (ae8c271) HEAD (16b22fc)
connectors 91 1
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #6155       +/-   ##
==========================================
- Coverage   39.97%   0.09%   -39.89%     
==========================================
  Files        2092    1629      -463     
  Lines      124963   98548    -26415     
==========================================
- Hits        49960      94    -49866     
- Misses      75003   98454    +23451     
Flag Coverage Δ
baseline 0.00% <0.00%> (ø)
connectors 96.90% <ø> (+22.33%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add external import for BeaconBeagle Data

2 participants