Kibana: [SIEM] Add Another Reputation Link

[angorayc]

This ticket is to keep track of the discussion of adding custom reputation link, the original question can be found here: here

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[angorayc]

@tsg , to make sure that I implement correctly, does it means that we are going to add one more configuration under Kibana's Advanced settings?

[tsg]

Me and @angorayc chatted on Slack. To summarize:

The setting could be an array of dicts, something like this:

[
  {"name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{ip}}"},
  {"name": "talosintelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{ip}}"},
  {"name": "custom", "url_template": "https://mysite.com/{{ip}}"}
]

The name of the setting should be "SIEM IP Reputation Links".

The description could be something like: "Array of URL templates to build the list of reputation URLs to be displayed on the IP Details page."

The array should probably be limited to 5 items or so, to avoid layout issues.

Besides that, I'm only worried about the potential of abuse here. Angela, it would be good to check that the IP field doesn't contain any non-IP characters (/, etc.) and that the template itself is not more than an URL (to avoid injecting JS or other tricks).

[angorayc]

@tsg, Found that virustotal link is reused by zeekRowRenderer. Therefore would like to know if we are going to apply the same change for zeekRowRenderer as well?

[angorayc]

After having a chat on slack with Tudor, put my summary here:
We just put the first item which appears in the reputation link config here in zeekRowRenderer.