CRX files are not being sent to external data enrichment providers in Security Analytics
Article ID: 276349
Updated On:
Products
Issue/Introduction
CRX is a Chrome Extension file and can be an interesting file to monitor for possible security issues. Even when adding mime_type="application/x-chrome-extension" to the indicator, the file is not being sent to an external provider such as Titanium Scale.
Cause
The magic mime type filter is causing the CRX file to not get sent correctly. The rule matches the "Content-Type: application/x-chrome-extension". The CRX file is extracted, but when the magic mime type is checked against /etc/solera/config/tonicfilter.conf, which is shown in the GUI as below:
However, none of the categories displayed in the GUI include "application/x-chrome-extension". Therefore it will not send it to the specified data enrichment provider.
Resolution
The "application/x-chrome-extension" magic mime type needs to be added to a category that is sent to the data enrichment provider.
A good section to include it as part of the "Archives" category. The magic mime type of "application/x-chrome-extension" needs to be added to /etc/solera/config/tonicfilter.conf.
Edit the tonicfilter.conf file and locate the "archives" section and add application/x-chrome-extension to the bottom of the list as shown below:
"archives": ["application/rar","application/x-rar","application/x-rar-compressed","application/x-redhat-package-manager","application/x-rpm","application/epub+zip","application/vnd.ms-cab-compressed","application/x-7z-compressed","application/x-cab","application/x-cab-compressed","application/x-cabinet","application/x-compress","application/x-compressed","application/x-cpio","application/x-xz","application/x-zip","application/x-zip-compressed","application/zip","multipart/x-zip","application/gzip","application/gzip-compressed","application/gzipped","application/x-gunzip","application/x-gzip","application/x-gzip-compressed","application/x-tgz","gzip/document","application/bz2","application/bzip2","application/x-bz2","application/x-bzip","application/x-bzip2","application/x-chrome-extension"],
After it is added, save the file and then restart extractord:
service solera-extractord restart
Confirm that the files are now being sent to the external data enrichment provider.
Feedback
