ThreatConnect Feed

Details

ID	`ThreatConnect Feed`
Provider	Dataminr
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10399583`
Supported Modules	Agentix XSIAM

README

This integration fetches indicators from ThreatConnect.
This integration was integrated and tested with version 3 of ThreatConnect Feed.

ThreatConnect Feed HMAC credentials

On the top navigation bar, hover the cursor over the Settings icon and select Org Settings from the dropdown menu.
Click the Create API User button on the Membership tab of the Organization Settings screen, and the API User Administration window will be displayed.
Fill up the following parts of the form:
- First Name: Enter the API user’s first name.
- Last Name: Enter the API user’s last name.
- Organization Role: Use the dropdown menu to select an Organization role for the user.
- Include in Observations and False Positives: Check this box to allow data provided by the API user to be included in observation and false-positive counts.
- Disabled: Click the checkbox to disable an API user’s account in the event that the Administrator wishes to retain log integrity when the API user no longer requires ThreatConnect access.
Record the Secret Key, as it will not be accessible after the window is closed.
Click the SAVE button to create the API user account.

For more information - click here (Section - Creating an API User).

Configure ThreatConnect Feed on Cortex XSOAR

Navigate to one of the following:
Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances.
Cortex XSOAR 6: Settings > Integrations.
Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations.
Search for ThreatConnect Feed.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Base URL	The API URL.	True
Access ID	The API ID key	True
Secret key	The secret key for the API.	True
Indicators to get per fetch	The number of indicators to get per fetch.	False
Tags to filter results by	A comma-separated list of tags to filter by.	False
Owners	A comma-separated list of owners to fetch indicators from.	False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Feed Fetch Interval	The time interval we send request to fetch indicators.	False
Trust any certificate (not secure)	Whether to trust any certificate.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Indicator types	Fetch specific ThreatConnect indicator types. Default value is “All”.	False
Group types	Fetch specific ThreatConnect group types. Default value is “All”.	False
Active Indicators Only	Fetch active only indicators when true. Default is “True”.	False
Create Relationships	Fetch related indicators. Default is “False”.	False
Indicator Query	Filter results using ThreatConnect Query Language (TQL). For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article	False
Use Indicator Query For Group	Use the ThreatConnect Indicator Query for group filtering. Default is “True”.	False
Group Query	Filter results using ThreatConnect Query Language (TQL). For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article	False
Confidence Threshold	Minimal confidence value to fetch indicators by (an integer between 0 to 100). Note: this parameter is not relevant for groups.	False
Threat Assess Score Threshold	Minimal threat assess score value to fetch indicators by (an integer between 0 to 1000). Note: this parameter is not relevant for groups.	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tc-get-indicators

Gets indicators from ThreatConnect.

Base Command

tc-get-indicators

Input

Argument Name	Description	Required
owners	Comma-separated list of owners to fetch indicators from. (If not specified will retrieve only indicators owned by the account. If you supply this argument, it overwrites the “Owners” parameter.).	Optional
limit	The maximum number of indicators to retrieve. Default is 50.	Optional
offset	The index of the first indicator to fetch. Possible values are: . Default is 0.	Optional
tql_query	Filter results using ThreatConnect Query Language (TQL), will override all other arguments. For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article.	Optional
indicator_type	Comma-separated list that will allow filtering of the retrieved indicators. Possible values are: All, EmailAddress, File, Host, URL, ASN, CIDR, Mutex, Registry Key, Address.	Optional
active_indicators	If true, fetches only active indicators. Possible values are: true, false. Default is true.	Optional
confidence	This will fetch indicators with confidence of “greater than” the (integer) input.	Optional
threat_assess_score	An integer that will determine the threshold (an integer between 0 to 1000).	Optional

Context Output

There is no context output for this command.

Command example

!tc-get-indicators limit=1 offset=0 indicator_type=URL active_indicators=true

Human Readable Output

ThreatConnect Feed - Indicators

fields rawJSON relationships score type value

firstseenbysource: 2022-09-27T17:20:19Z
updateddate: 2022-09-27T17:20:19Z
description: This indicator appears in a post from VirIT.
name: name
address: address
reportedby: Technical Blogs and Reports id: 98590287
ownerName: Technical Blogs and Reports
dateAdded: 2022-09-27T17:20:19Z
webLink: link
type: URL
lastModified: 2022-09-27T17:20:19Z
rating: 3.0
confidence: 70
source: source
description: This indicator appears in a post from VirIT.
summary: address/
privateFlag: false
active: true
activeLocked: false
text: address 0 URL address

fields	rawJSON	relationships	score	type	value
firstseenbysource: 2022-09-27T17:20:19Z updateddate: 2022-09-27T17:20:19Z description: This indicator appears in a post from VirIT. name: name address: address reportedby: Technical Blogs and Reports	id: 98590287 ownerName: Technical Blogs and Reports dateAdded: 2022-09-27T17:20:19Z webLink: link type: URL lastModified: 2022-09-27T17:20:19Z rating: 3.0 confidence: 70 source: source description: This indicator appears in a post from VirIT. summary: address/ privateFlag: false active: true activeLocked: false text: address		0	URL	address

Command Example

!tc-get-indicators limit=2 offset=0

Human Readable Output

rawJSON score type value

id: Indicator01 2 IP 8.8.8.8

id: Indicator02 3 IP 8.8.4.4

rawJSON	score	type	value
id: Indicator01	2	IP	8.8.8.8
id: Indicator02	3	IP	8.8.4.4

tc-get-owners

Gets available indicators owners.

Base Command

tc-get-owners

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Human Readable Output

ThreatConnect Feed - Owners

id name type

10303 NAME-01 Organization

10666 NAME-02 Source

id	name	type
10303	NAME-01	Organization
10666	NAME-02	Source

Configuration parameters

tc_api_path — Base URL (required)
api_credentials — Access ID (required)
api_access_id — Access ID
api_secret_key — Secret key
fetch_limit — Indicators to get per fetch
tags — Tags to filter results by
owners — Owners
feedIncremental — Incremental feed
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
indicator_type — Indicator types
group_type — Group types
indicator_active — Active Indicators Only
createRelationships — Create Relationships
indicator_query — Indicator Query
use_indicator_query_for_group — Use Indicator Query For Group
group_query — Group Query
confidence — Confidence Threshold
threat_assess_score — Threat Assess Score Threshold
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
insecure — Trust any certificate (not secure)
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags

Commands (2)

tc-get-indicators
Gets indicators from ThreatConnect.
tc-get-owners
Gets available indicators owners.

Source

FeedThreatConnect.py FeedThreatConnect_test.py FeedThreatConnect.yml FeedThreatConnect_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Dataminr
commonfields:
  id: ThreatConnect Feed
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.threatconnect.com
  display: Base URL
  name: tc_api_path
  required: true
  type: 1
  section: Connect
- displaypassword: Secret key
  additionalinfo: The API ID key
  display: Access ID
  name: api_credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: API - Access ID
  display: Access ID
  name: api_access_id
  type: 4
  hidden: true
  required: false
  section: Connect
- additionalinfo: API - Secret key
  display: Secret key
  name: api_secret_key
  type: 4
  hidden: true
  required: false
  section: Connect
- defaultvalue: '2000'
  additionalinfo: The number of indicators to get per fetch.
  display: Indicators to get per fetch
  name: fetch_limit
  type: 0
  required: false
  section: Collect
- additionalinfo: A comma-separated list of tags to filter by.
  display: Tags to filter results by
  name: tags
  type: 0
  required: false
  section: Collect
- display: Owners
  name: owners
  type: 0
  additionalinfo: A comma-separated list of owners to fetch indicators from.
  required: false
  section: Collect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. The determination if the indicator is new or modified happens on the 3rd-party vendor's side, so only indicators that are new or modified are sent to Cortex XSOAR. Therefore, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental feed
  hidden: true
  name: feedIncremental
  type: 8
  required: false
  section: Collect
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  defaultvalue: 'Bad'
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  name: feedReputation
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  defaultvalue: F - Reliability cannot be judged
  section: Collect
- display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  required: false
  section: Collect
- display: Indicator types
  name: indicator_type
  type: 16
  options:
  - All
  - EmailAddress
  - File
  - Host
  - URL
  - ASN
  - CIDR
  - Hashtag
  - Mutex
  - Registry Key
  - User Agent
  - Address
  additionalinfo: Fetch specific ThreatConnect indicator types. Default value is "All".
  defaultvalue: All
  required: false
  section: Collect
- display: Group types
  name: group_type
  type: 16
  additionalinfo: Fetch specific ThreatConnect group types. Default value is "All".
  defaultvalue: All
  options:
  - All
  - Attack Pattern
  - Campaign
  - Course of Action
  - Intrusion Set
  - Malware Report
  - Tool
  - Vulnerability
  required: false
  section: Collect
- display: Active Indicators Only
  name: indicator_active
  type: 8
  defaultvalue: 'true'
  additionalinfo: Fetch active only indicators when true. Default is "True".
  required: false
  section: Collect
- display: Create Relationships
  name: createRelationships
  type: 8
  additionalinfo: Fetch related indicators. Default is "False".
  defaultvalue: 'false'
  required: false
  section: Collect
- additionalinfo: Filter results using ThreatConnect Query Language (TQL). For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article
  display: Indicator Query
  name: indicator_query
  type: 12
  required: false
  section: Collect
- display: Use Indicator Query For Group
  type: 8
  additionalinfo: |-
    Use the ThreatConnect Indicator Query for group filtering. Default is "True".
  name: use_indicator_query_for_group
  defaultvalue: 'true'
  section: Collect
  required: false
- additionalinfo: |-
    Filter results using ThreatConnect Query Language (TQL). For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article
  display: Group Query
  name: group_query
  type: 12
  required: false
  section: Collect
- display: 'Confidence Threshold'
  name: confidence
  type: 0
  required: false
  additionalinfo: |
    Minimal confidence value to fetch indicators by (an integer between 0 to 100). Note: this parameter is not relevant for groups.
  defaultvalue: 0
  section: Collect
- display: 'Threat Assess Score Threshold'
  name: threat_assess_score
  type: 0
  required: false
  additionalinfo: |
    Minimal threat assess score value to fetch indicators by (an integer between 0 to 1000). Note: this parameter is not relevant for groups.
  defaultvalue: 0
  section: Collect
- display: ''
  name: feedExpirationPolicy
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  section: Collect
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  defaultvalue: '240'
  section: Collect
- display: Trust any certificate (not secure)
  type: 8
  name: insecure
  required: false
  section: Connect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- display: Tags
  type: 0
  additionalinfo: Supports CSV values.
  name: feedTags
  hidden: true
  required: false
  section: Collect
description: This integration fetches indicators from ThreatConnect.
display: ThreatConnect Feed
name: ThreatConnect Feed
script:
  commands:
  - arguments:
    - description: |-
        Comma-separated list of owners to fetch indicators from. (If
        not specified will retrieve only indicators owned by the account. If you supply this argument, it overwrites the "Owners" parameter.)
        .
      name: owners
    - defaultValue: '50'
      description: The maximum number of indicators to retrieve.
      name: limit
    - defaultValue: '0'
      description: The index of the first indicator to fetch.
      name: offset
      predefined:
      - ''
    - description: Filter results using ThreatConnect Query Language (TQL), will override all other arguments. For more information, see the ThreatConnect documentation https://training.threatconnect.com/learn/article/using-threatconnect-query-language-tql-kb-article
      name: tql_query
    - auto: PREDEFINED
      description: Comma-separated list that will allow filtering of the retrieved indicators.
      name: indicator_type
      predefined:
      - All
      - EmailAddress
      - File
      - Host
      - URL
      - ASN
      - CIDR
      - Mutex
      - Registry Key
      - Address
    - auto: PREDEFINED
      defaultValue: 'true'
      description: If true, fetches only active indicators.
      name: active_indicators
      predefined:
      - 'true'
      - 'false'
    - description: This will fetch indicators with confidence of “greater than” the (integer) input.
      name: confidence
    - description: An integer that will determine the threshold (an integer between 0 to 1000).
      name: threat_assess_score
    description: Gets indicators from ThreatConnect.
    name: tc-get-indicators
  - description: Gets available indicators owners.
    name: tc-get-owners
  dockerimage: demisto/python3:3.12.13.10399583
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- FeedThreatConnect-Test
fromversion: 5.5.0