Connectors

Connectors

Automate detection-data enrichment from your third-party security tools


Connectors automate the enrichment of detection data from third-party solutions by relying on their APIs. They are optional modules you can attach to your attack campaign to enrich your results with additional insights. Once activated, a connector provides detection data for each event and, in Automatic mode, lets BlackNoise qualify the detection for you (see Detection qualification mode below).
The available connectors mainly target EDR, NDR, XDR and SIEM solutions. This page lists all the connectors available in the BlackNoise platform.


Configure a connector

From the Connectors page, configure a connector by entering its connection information — mainly:
  • the access URL provided to you as a user of the third-party solution;
  • an API key.
For some connectors, an option lets you disable verification of the remote TLS certificate. Use it only when the third-party solution presents a self-signed certificate, or one signed by an internal authority that is not publicly recognized.
Once the connection information is filled in, click Save and Connect. BlackNoise runs connection tests; if they pass, the connector becomes operational.


Use a connector in a campaign

You select connectors when creating a campaign: among those you have configured, you can choose one or more to enrich that campaign's results. See  Security validation  for the campaign creation steps.
Important. When a campaign uses at least one connector, the delay between two events must be at least one minute. BlackNoise searches each detection tool over the execution window of an event, widened by a margin before its start and after its end. This one-minute buffer keeps the windows of consecutive events apart, so a detection cannot be attributed to the wrong event.
For each system event, the connector provides an access URL that opens the third-party tool's interface directly, pre-filtered to show only the information relevant to that event. This link is available as soon as the event has run. BlackNoise usually builds it from information it already holds, without querying the third-party solution. Some connectors need an API call to build it, for example to find the identifier the tool gives to the target. Each connector page states how its link is built.
In addition, with some enriched connectors, each individual element detected by the tool is incorporated into the corresponding BlackNoise event, providing more detailed data (command detected, severity of the detection, action taken by the detection tool...). This enrichment relies on API calls to the third-party solution, so it runs once every event of the simulation has finished executing: the simulation stays in the Gathering more data status while the connectors are queried, then moves to Completed (see  Campaign & simulation statuses ). To retrieve the connector data again once the simulation has completed, use the refresh button on the simulation.
This information streamlines analysts' work: they can quickly confirm that detection worked, validate technical qualification criteria — for example the severity or technical description reported by the detection tools against the identified threat — and check the countermeasures that were applied.


Detection qualification mode

Each connector you select for a campaign has a detection qualification mode. It sets who qualifies the detection of the campaign's events: you, or BlackNoise.

Choose the mode

The choice is made connector by connector, when you create the campaign. When you tick a connector, a Detection qualification mode area unfolds under its name, with two options:
  • Automatic — BlackNoise sets each event's detection status from the alerts reported by the connector.
  • Semi-automatic — the connector provides detection data, and you qualify each event yourself.
Automatic is preselected. The choice cannot be changed once the campaign is created. A connector that does not support Automatic mode shows Semi-automatic only. Each connector page states which modes it supports. In Semi-automatic mode, the connector still gives you the pre-filtered link and the collected data on each event, but BlackNoise sets no status.

How BlackNoise matches alerts to events

In Automatic mode, BlackNoise looks for each event in the alerts returned by the connector:
    It keeps the alerts raised on the target IP address of the event, within the time window of the event. The window uses the time corrected for the clock drift measured between the Attack Vector and the platform. Two consecutive events never share a window, so an alert belongs to one event only.
    For EDR, XDR and SIEM, it looks for the commands of the event's IOCs in the commands reported by these alerts. An IOC command matches when it is included in a reported command line, whatever the case or the number of spaces. For example, the IOC command mkdir C:\Windows\Temp\blckns\BLCKNS_DEF_W0022.020 is found in the reported command line C:\WINDOWS\system32\cmd.exe /C mkdir C:\Windows\Temp\blckns\BLCKNS_DEF_W0022.020. What the tool adds around the action, such as the calling interpreter, has no effect.
    It sets the detection status. If at least one IOC command is found, the event is Alerted. Connectors that also read the tool's telemetry can set Logged when there is no alert but the execution of the event appears in the traces. Otherwise, the event stays Unqualified: no command was found, the event is not covered by the connector (for example a network event with an EDR), or the collection failed.

What BlackNoise fills in

When it sets a status, BlackNoise also fills in the detection source and the detection date. The date is the time of the first alert matched to the event, and the Time to Detect (TTD) is computed from it.
The source is a dedicated detection source, created for each connector that supports Automatic mode as soon as you configure it successfully. It belongs to the Detection & response category and is named after the connector in lowercase, followed by -connector, for example defender-connector. You can rename it but not delete it. It cannot be selected when you qualify an event manually, and it is kept if the connector is disabled or removed, so past campaigns keep their history.
When several connectors are active on a simulation, one detection is enough for an event to be Alerted. The detection date is then the one closest to the event's execution, and the source field lists every connector that detected the command.

Edit the result

Nothing is locked: you can edit and complete the detection information of any event, for example to add evidence (see  Event details ). The most recent change prevails: a manual edit replaces an automatic status, and an automatic qualification run later replaces a manual one. In the Activity logs, automatic changes are attributed to BlackNoise App instead of a user. Reaction information is never filled in automatically.