- Related Topics
- Configuring 3rd Party Modules for SecureX Integrations
- Download the module source from GitHub (Module)
- Generate the JWT Token
- Upload Serverless App to AWS
- Configure AWS environment variable
- Configure the SecureX Integration Module
- Related Topics
- Command Line Cheat Sheet
NEWS: Cisco hosted SecureX Integration Modules
Cisco Secure is moving forward with Cisco hosted SecureX Integration Modules, where you do not need Serverless or docker any more. Find details in Part 1 of the documentation.
If you are moving to the Cisco hosted version of the Integration Modules the steps below are not necessary.
Related Topics
Configuring 3rd Party Modules for SecureX Integrations
This steps explains some easy steps to configure, upload and integrate 3rd Party enrichment modules.
There are just some simple steps to do. The following steps are similar to all of the modules available on Github.
Before we start, let us clone a Template GitHub Repository, because it also includes a Python Script we need later to configure the JWT token.
Step: JWT Source (not necessary any more): Clone the JWT Token Git Repository to download the Python Script for the token generation we need later: git clone https://github.com/CiscoSecurity/tr-05-jwt-generator.git.
Note: Cisco constantly enhances the 3rd Party integrations. The JWT Token generation is now implemented as a command line tool. So you can skip this step.
Download the module source from GitHub (Module)
- Step: Download: Open SecureX and go to SecureX → Integrations.
- Step: Download: Click the "Add Module" Button to get some more info about the Module.
-
Step: Download: The module points directly to Github. Just click the ".... Serverless Relay" link.
In the GitHub UI click "Code" to get the dropdown including Link for cloning.Github Download URL
Note: When executing the following commands, it is essential to do this in the right folder!
-
Step: Download: Start the virtual environment, if not already started, using the command line: source securex/bin/activate
Note: you must be in the directory /usr/local/SecureX, otherwise the virtual environment cannot be started.
-
Step: Download: In the root folder of our virtual environment type the following command.
As seen in the screenshot above (using AbuseIPDB as an example):
git clone https://github.com/CiscoSecurity/tr-05-serverless-abuseipdb.git. - Step: Download: Update the necessary components using the command: pip install --upgrade --requirement requirements.txt
Note: Always do this step, some modules may need different libraries to work probably. There will not be any issue with your deployment. The needed components are listed in the requirements.txt file.
Generate the JWT Token
We already downloaded the necessary source. This section describes how to generate all Tokens we need for the SecureX Integration authentication bearer and the AWS SECRET_KEY value.
Note: There are Modules available which to not need any Authentication Bearer, e.g. like the Shodan Module. So you can skip the JWT Token generation. Always take a look for specific Module Settings on GitHub.
-
Step: JWT Token: Generate an API key from the 3rd Party Vendor. Many of them a providing community
or free APIs which can be used to test the Integration. Follow the steps and guides as outlined there.Note: In August 2020 we simplified the token generation, so you do not need to copy the jwt_generator.py file any more. All necessary files are already included when cloning the tr-05-serverless-relay code from Github and afterwards updating the app.
Execute the following commands to upgrade an existing virtual environment starting in directory /usr/local/SecureX/tr-05-serverless-relay/.
1. Update the local code: git pull
This updates the requirements.txt file
2. Install the latest components including the jwt command line tool: pip install --upgrade --requirement requirements.txt - Step: JWT Token: Now let´s generate a JWT Token (JSON Web Token), which is needed to authenticate.
If you want to know more about this authentication mechanism, take a look at the Documentation. The JWT Token
can easily generated with a single statement.
-
Switch into the directory: cd /usr/local/SecureX/tr-05-serverless-abuseipdb/
-
Generate the JWT token using the command: jwt dev
-
-
Copy the output, you will need the generated tokens later.
-
Upload Serverless App to AWS
Now let us upload the Application to AWS:
-
Step: Upload/Deploy Package: Before uploading the WebApp to AWS, we have to ensure, that the s3_Package which is generated during upload, is unique. To do so, we have to modify the zappa_settings.json file.
The easies way is to add your AWS AccountID to the s3_bucket definition in the zappa_settings.json file.{ "dev": { "app_function": "app.app", "aws_region": "us-east-1", "exclude": [".*", "*.json", "*.md", "*.txt"], "keep_warm": false, "log_level": "INFO", "manage_roles": false, "profile_name": "serverless", "project_name": "tr-abuseipdb-relay", "role_name": "tr-serverless-relay-ZappaLambdaExecutionRole", "runtime": "python3.7", "s3_bucket": "zappa-tr-abuseipdb-relay-XXXXXXXXXXXX" } } -
Step: Upload/Deploy Package: Deploy the App to AWS using the following Command: zappa deploy dev.
- Step: Upload Package: Write down the shown URL to access your Lambda app.
Note: You can check the URL and other settings by typing: zappa status dev.
Configure AWS environment variable
The last configuration step is to add an environment variable to the Lambda function on AWS.
- Step: AWS environment variable: The JWT token Output shows the URL to jump directly to the AWS Setting:
https://console.aws.amazon.com/lambda/home?region=us-east-1#/functions/tr-abuseipdb-relay-dev/edit/environment-variables?tab=configuration.
You can also go to the settings manually by selecting the Lambda Service in the AWS UI. Click the Function name to get
to the environment variables.AWS environment variable
- Step: AWS environment variable: Scroll down to the Environment variables and click the "Manage Environment variables"
button.AWS environment variable
- Step: AWS environment variable: Click the "Add environment variable" button
- Step: AWS environment variable: Add the following values
- Key: SECRET_KEY
- Value: the JWT Token output (The SECRET_KEY to validate the JWT is: )
AWS environment variable
- Step: AWS environment variable: Click the SAVE Button to finish.
Configure the SecureX Integration Module
Add the necessary values to the Module Settings:
- URL: The URL shown during the App deployment to AWS or by checking the App settings using the command
zappa status dev. - Authorization Bearer: The long JWT token generated before (E.g. The JWT for the AbuseIPDB IP Checker module is:....)
Repeat these steps to add other available integrations.
Related Topics
Command Line Cheat Sheet
- Start the virtual environment: source securex/bin/activate
- Stop the virtual environment: deactivate