Amazon SQS

The SQS operator allows ThreatIngestor to integrate out-of-the-box with any system that supports reading from SQS queues. This operator is extremely flexible, as it accepts arbitrary config options and passes them through to the queue.

Configuration Options

• module (required): sqs
• aws_access_key_id (required): Your AWS access key ID.
• aws_secret_access_key (required): Your AWS secret access key.
• aws_region (required): Your AWS region name.
• queue_name (required): The name of the SQS queue you want to use.

Any other options defined in the SQS operator section will be passed in to your queue as part of a JSON object, after string interpolation to fill in artifact content. For example, {domain} will be replaced with the C2 domain being exported.

Example Configuration

The following example assumes AWS credentials have already been configured in the credentials section of the config, like this:

credentials:
  - name: aws-auth
    aws_access_key_id: MYKEY
    aws_secret_access_key: MYSECRET
    aws_region: MYREGION

Inside the operators section of your configuration file:

- name: myqueue
  module: sqs
  credentials: aws-auth
  queue_name: my-queue
  domain: {domain}
  url: {url}
  source_type: url
  download_path: /data/ingestor

In this example, the resulting JSON object for a URL artifact of http://example.com/ sent to the SQS queue would be:

{
    "domain": "example.com",
    "url": "http://example.com/",
    "source_type": "url",
    "download_path": "/data/ingestor"
}