Last Quarter Mile Toolset

The Last Quarter Mile Toolset (LQMT) is used to automate action to endpoint defense tools using data from Cyber Threat Intelligence (CTI).

Overview

LQMT works by taking CTI data and breaking it down into a common data format. Specialized tools designed to interface with endpoint defense tools take this common data format and communicate the parsed CTI data to the endpoint tools. LQMT is able to string these tools together in a group called ToolChains, so you can automate actions to a variety of different tools all at once.

Text-based diagram of how CTI Data flows to a chain of tools using LQMT:

                    ---> Firewall
                   /
CTI Data ---> LQMT ----> SIEM
                   \
                    ---> Syslog

Supported Tools

The following endpoints tools and actions are supported by LQMT:

Tool	Actions Supported
Checkpoint	Automated Firewall Blocks
Palo Alto	Automated Firewall Blocks
Arcsight Logger	Data Routing
Splunk	Data Routing
Syslog	Data Routing
Bro	Data Translation
Flextext	Data Translation
Snort	Automated Rule Injection
Snort (Pull)	Matching Snort Logs for Submission

Open source

The code for LQMT is open source, and available on Github. New tools and features are actively being developed for LQMT, but user contributions are welcome via pull requests.

Contact

LQMT is developed and supported by the CFM team at Argonne National Lab. Any questions about LQMT can be directed to the CFM team at cfmteam@anl.gov. For general information about the CFM project, visit our website.