Configuring intel
Red Kite comes with intel for the most common exposed services, but any filter can become an intel. This is a powerful way to turn a recurring issue, or an interesting result from a penetration test, into something Red Kite detects everywhere, continuously.
Creating an intel definition
Any filter can become an intel. This is a powerful way to turn a recurring issue, or an interesting result from a penetration test, into something Red Kite detects everywhere, continuously.
- Go to Management > Intel definitions and click New intel definition.
- Give it a name, a description and one or more recommendations. You can add a second language for your users.
- Choose the severity and the resource type it applies to: domain, host, port, website or IP range.
- Write the detection query. Start with
-is:blockedso that blocked resources are ignored. The search bar suggests the filters available for the chosen resource type.
Some ideas of custom intel:
| Intel | Resource type | Detection query |
|---|---|---|
| An outdated product version | Port | -is:blocked port.product:openssh port.version:7.* |
| A verified website without a WAF | Website | -is:blocked confidence:verified -finding.WafFinding:exists |
| Any resource with a result from a custom job | Any | -is:blocked finding.MyCustomFinding:exists |
Before saving an intel definition, paste its detection query in the matching resource page to check what it returns.
To detect something that Red Kite does not collect yet, first create a custom job that emits a finding, then create an intel that looks for that finding.
Default intel definitions
The intel definitions shipped with Red Kite are read-only. You can see them, along with the resources they affect, in Management > Intel definitions. See Intel for the list.