Anomali ThreatStream Feed

Details

ID	`Anomali ThreatStream Feed`
Provider	Anomali
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`

README

Use the Anomali ThreatStream Feed Integration to fetch indicators from the Anomali ThreatStream.

Configure Anomali ThreatStream Feed in Cortex

Parameter	Description	Required
Fetch indicators	Enable this checkbox to automatically pull indicators from the Anomali ThreatStream at regular intervals.
Fetch by	Fetch by the modification or creation time of the indicators.	True
Server URL (e.g., https://www.test.com)	Confirm that the pre-filled URL matches the correct API endpoint for your Anomali ThreatStream instance.	True
Username		True
API Key		True
Feed Fetch Interval		False
Confidence Threshold	Will only return indicators above the confidence threshold.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. Indicator’s TLP will override the default value.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation. If not selected, Indicators’ verdicts are determined by their Dbot score from the API. The default is Unknown.	False
Indicator Expiration Method	The method by which to expire indicators from this feed for this integration instance.	False
Create relationships		False
Trust any certificate (not secure)		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

threatstream-feed-get-indicators

Gets indicators from the feed. This command is mainly used for testing and debugging purposes.

Base Command

threatstream-feed-get-indicators

Input

Argument Name	Description	Required
indicator_type	The indicator type to analyze. If not selected, indicators from all types are retrieved. Possible values are: domain, ip, md5, url, email.	Optional
limit	Maximum number of objects to return. Default is 10.	Optional
sort_by	Sort the records in descending order according to the Created or Modified Time. Possible values are: Created Time, Modified Time. Default is Modified Time.	Optional

Context Output

There is no context output for this command.

Command example

!threatstream-feed-get-indicators indicator_type="domain" limit="5" sort_by="Created Time"

Human Readable Output

Indicators from Anomali ThreatStream Feed

Source ThreatStreamID Domain Modified Confidence Creation Tags TrafficLightProtocol

Demisto 440576095 my.domainnn_test.com 2023-12-24T00:00:05.890Z 50 2023-06-20T08:07:33.841Z values: tag3452, tag23452

Demisto 440126275 my.domain_987.com 2023-12-24T00:00:05.877Z 50 2023-06-19T12:14:52.216Z values: tag3452, tag23452

Demisto 439658732 my.domain1357.com 2023-09-16T10:10:05.788Z 50 2023-06-18T10:02:07.876Z

dummydomain.com 284008208 test_domain_121.com 2025-04-05T01:48:33.997Z 0 2021-11-16T09:40:10.407Z values: tag4567 amber

Analyst 231953546 abc_test_domain1.com 2023-07-17T09:55:54.228Z 60 2021-04-06T09:36:09.122Z values: tag1356

Source	ThreatStreamID	Domain	Modified	Confidence	Creation	Tags	TrafficLightProtocol
Demisto	440576095	my.domainnn_test.com	2023-12-24T00:00:05.890Z	50	2023-06-20T08:07:33.841Z	*values*: tag3452, tag23452
Demisto	440126275	my.domain_987.com	2023-12-24T00:00:05.877Z	50	2023-06-19T12:14:52.216Z	*values*: tag3452, tag23452
Demisto	439658732	my.domain1357.com	2023-09-16T10:10:05.788Z	50	2023-06-18T10:02:07.876Z
dummydomain.com	284008208	test_domain_121.com	2025-04-05T01:48:33.997Z	0	2021-11-16T09:40:10.407Z	*values*: tag4567	amber
Analyst	231953546	abc_test_domain1.com	2023-07-17T09:55:54.228Z	60	2021-04-06T09:36:09.122Z	*values*: tag1356

Configuration parameters

feed — Fetch indicators
fetchBy — Fetch by (required)
url — Server URL (e.g., https://www.test.com) (required)
credentials — Username (required)
feedFetchInterval — Feed Fetch Interval
confidenceThreshold — Confidence Threshold
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedReputation — Indicator Reputation
feedExpirationPolicy —
createRelationships — Create relationships
insecure — Trust any certificate (not secure)

Commands (1)

threatstream-feed-get-indicators
Gets indicators from the feed. This command is mainly used for testing and debugging purposes.

Source

AnomaliThreatStreamFeed.py AnomaliThreatStreamFeed_test.py AnomaliThreatStreamFeed.yml AnomaliThreatStreamFeed_description.md command_examples.txt

Download History Raw

## Anomali ThreatStream Feed Integration Help

Anomali ThreatStream is a leading threat intelligence platform designed to help organizations collect, analyze, and act on vast amounts of threat data.
This integration allows you to automatically fetch Indicators of Compromise (IOCs) such as IPs, domains, URLs, and file hashes directly into your security operations platform, enhancing your ability to detect and respond to cyber threats.

### How to Configure Your Integration

General Configuration

API Key: Paste the API key you retrieved from your Anomali ThreatStream account into this field.
To access ThreatStream using the API, you need a user ID and API key. To get these credentials, register at [http://ui.threatstream.com](http://ui.threatstream.com).