ThreatConnect v3

ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.

Data Enrichment & Threat Intelligence · ThreatConnect

Configuration parameters

  • baseUrl — Base Url (required)
  • accessId — Access ID
  • api_secret_key — Access ID (required)
  • defaultOrg — Default Organization
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • first_fetch — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
  • max_fetch — Maximum number of incidents to fetch
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • tags — Tags filter for the fetch
  • group_type — Group Type filter for the fetch
  • status — Status filter for the fetch
  • tql_filter — TQL Filter
  • fields — Incident Metadata
  • integrationReliability — Source Reliability (required)
  • rating — Rating Threshold for Malicious Indicators
  • confidence — Confidence Threshold for Malicious Indicators
  • freshness — Indicator Reputation Freshness in days

Commands (55)

  • domain

    Searches for an indicator of type domain.

  • file

    Searches for an indicator of type file.

  • ip

    Searches for an indicator of type IP address.

  • tc-add-group-attribute Deprecated

    Deprecated. Use the tc-update-group command.

  • tc-add-group-security-label Deprecated

    Deprecated. Use the tc-update-group command.

  • tc-add-group-tag

    Adds tags to a specified group.

  • tc-add-indicator

    Adds a new indicator to ThreatConnect.

  • tc-associate-group-to-group Deprecated

    Deprecated. Use the tc-update-group command.

  • tc-create-campaign

    Creates a group based on the Campaign type.

  • tc-create-document-group

    Creates a document group.

  • tc-create-event

    Creates a group based on the Event type.

  • tc-create-incident

    Creates a new incident group.

  • tc-create-threat

    Creates a group based on the "Threats" type.

  • tc-create-victim

    Creates a victim.

  • tc-create-victim-asset

    Creates a victim asset.

  • tc-create-victim-attribute

    Creates a victim attribute.

  • tc-delete-group

    Deletes a group.

  • tc-delete-indicator

    Deletes an indicator from ThreatConnect.

  • tc-delete-indicator-tag

    Removes a tag from a specified indicator.

  • tc-delete-victim

    Deletes a victim.

  • tc-delete-victim-asset

    Deletes a victim asset.

  • tc-delete-victim-attribute

    Deletes a victim attribute.

  • tc-download-document

    Downloads the contents of a document.

  • tc-download-report

    The group report to download in PDF format.

  • tc-fetch-incidents Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-associated-groups

    Returns groups associated with a specified group.

  • tc-get-events

    Returns a list of events.

  • tc-get-group Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-group-attributes Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-group-indicators Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-group-security-labels Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-group-tags Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-groups Deprecated

    Deprecated. Use the tc-list-groups command.

  • tc-get-incident-associate-indicators

    Returns indicators that are related to a specific incident.

  • tc-get-indicator

    Retrieves information about an indicator.

  • tc-get-indicator-owners

    Get the owner for an indicator.

  • tc-get-indicator-types

    Returns all indicator types available.

  • tc-get-indicators-by-tag

    Fetches all indicators that have a tag.

  • tc-get-tags

    Returns a list of all ThreatConnect tags.

  • tc-group-associate-indicator Deprecated

    Deprecated. Use the tc-update-group command.

  • tc-incident-associate-indicator

    Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.

  • tc-indicators

    Retrieves a list of all indicators.

  • tc-list-attribute-type

    Retrieved all attribute types.

  • tc-list-groups

    Returns all groups.

  • tc-list-victim-assets

    Retrieves victim assets.

  • tc-list-victim-attributes

    Retrieves victim attributes.

  • tc-list-victims

    Retrieves victims.

  • tc-owners

    Retrieves all owners for the current account.

  • tc-tag-indicator

    Adds a tag to an existing indicator.

  • tc-update-group

    Updates a group.

  • tc-update-indicator

    Updates the indicator in ThreatConnect.

  • tc-update-victim

    Updates a victim.

  • tc-update-victim-asset

    Updates a victim asset.

  • tc-update-victim-attribute

    Updates a victim attribute.

  • url

    Searches for an indicator of type URL.