STIX or TAXII Output from NSX Lastline Manager

Products

• VMware

Issue/Introduction

Problem

Is it possible to send STIX or TAXII output to our SIEM?

Solution

Yes it's possible to extract the reports in STIX format manually directly from our portal user.lastline.com (if you are an Hosted customer) or directly from your portal (if you are an On-Premise customer).

When you analyzed a file (so you are already under Analyst inside a task you completed) you can click on Report, and after on the blue cloud icon on the right side and select IOC in STIX format.

If you want use an automatic procedure instead unfortunately we don't provide any ready to use integration or tool but you can use our API to implement/create your own code.

Here the relative documentation:
https://analysis.lastline.com/docs/html/analysis_results/format_ll_ioc_json.html?highlight=stix
https://analysis.lastline.com/docs/html/api.html?highlight=get_ioc#api.analysis.get_ioc_metadata