How can I integrate STIX threat feeds into EventSentry's Threat Intel

Starting with version 4.2.3, EventSentry supports custom threat feeds (black lists) in addition to the built-in threat feeds. EventSentry loads additional IP address from the following file:

%systemroot%\system32\eventsentry\temp\eventsentry_threatintel_custom.tmp

This file needs to contain at minimum one IPv4 address per line but supports up to 3 fields (delimited by a semicolon ;) in the following format:

IPAddress;ThreatConfidence;ThreatSource

Example file contents (all lines are valid):

12.13.14.15;100;Log4j
12.13.14.15;100
12.13.14.15

The file is parsed every 4 hours, when the built-in threat feeds are also updated. If you have a threat feed in the STIX XML format, then you can use the following VBScript to convert the XML file into a flat text file with one IP address per line. Simple edit the file paths in the VBscript (fileStixInput and fileEventSentryOutput) and schedule it with the task scheduler to run whenever the stix feed is updated.

stix.vbs

Dim fileStixInput
Dim fileEventSentryOutput

fileStixInput = "C:\resources\stix\STIX_IP_Watchlist.xml"
fileEventSentryOutput = "C:\windows\system32\eventsentry\temp\eventsentry_threatintel_custom.tmp"

Dim oXML
Set oXML = CreateObject("Microsoft.XMLDOM")

Dim objFSO
Set objFSO=CreateObject("Scripting.FileSystemObject")

oXML.Load(fileStixInput)

Dim objFileEventSentryOutput
Set objFileEventSentryOutput = objFSO.CreateTextFile(fileEventSentryOutput, True)

For Each rootNodes In oXML.DocumentElement.ChildNodes
    If rootNodes.nodeName = "stix:Indicators" Then
        For Each nodeIndicator In rootNodes.ChildNodes

            Dim ignoreIteration
            ignoreIteration = False

            For Each indicatorElements In nodeIndicator.ChildNodes

                If indicatorElements.nodeName = "indicator:Type" And indicatorElements.text <> "IP Watchlist" Then
                    ignoreIteration = True
                End If

                If ignoreIteration <> True Then
                    If (indicatorElements.nodeName = "indicator:Observable") Then
                        For Each cyboxObject In indicatorElements.ChildNodes
                            For Each cyboxProperty In cyboxObject.ChildNodes
                                If (cyboxProperty.getAttribute("category") = "ipv4-addr") Then
                                    For Each addrObj In cyboxProperty.ChildNodes
                                        If addrObj.nodeName = "AddressObject:Address_Value" Then
                                            Dim ipAddresses
                                            ipAddresses = Split(addrObj.text, "##comma##")

                                            For Each ipAddr In ipAddresses
                                                objFileEventSentryOutput.Write ipAddr & vbCRLF
                                            Next
                                        End if
                                    Next
                                End If
                            Next
                        Next
                    End If
                End If
            Next
        Next
    End If
Next

objFileEventSentryOutput.Close