Threatmon

Integration with Threatmon for vulnerability threat intelligence.

Data Enrichment & Threat Intelligence · ThreatMon

Details

IDThreatmon
ProviderThreatMon
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775

README

ThreatMon Integration

Overview

The ThreatMon integration enables Cortex XSOAR to retrieve threat intelligence data from the ThreatMon API and update incidents automatically based on the incoming threat context.

This integration is designed to help security teams streamline incident enrichment and response by leveraging real-time intelligence from ThreatMon’s extensive threat database.

Use Cases

  • Enrich incidents in XSOAR with actionable threat intelligence from ThreatMon.
  • Automatically pull threat data and update incidents accordingly.
  • Support analyst decision-making with contextual threat data from an external source.

Key Features

  • Real-time threat data ingestion from the ThreatMon API.
  • Automated incident updates using custom playbooks or scheduled jobs.
  • Flexible command-based data retrieval (on-demand or automated).
  • Supports indicators such as IP addresses, domains, and file hashes.

Requirements

  • A valid ThreatMon API key (can be obtained from your ThreatMon dashboard).
  • IP based access permission to Threatmon API
  • Internet connectivity from your XSOAR instance to the ThreatMon API endpoint.

Configuration

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for ThreatMon.
  3. Click Add instance to create and configure a new integration instance:
    • Name: ThreatMon
    • API Key: Your ThreatMon API key
    • Base URL: https://external.threatmonit.io (or your custom endpoint)
  4. Click Test to validate the connection.
  5. Click Save.

Commands

Command Description
fetch-incidents Retrieves threat intelligence data for a specified indicator or time range.
threatmon_update_incident_status Updates the current incident with contextual threat intelligence.
threatmon_request_takedown Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.
threatmon_list_cves Retrieves a paginated list of all CVEs monitored by ThreatMon.
threatmon_list_subscribed_cves Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.
threatmon_request_data_removal Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits.

Note: Full command usage details and argument structures are available within the integration settings in XSOAR.

Troubleshooting

  • Make sure the API key is valid and not expired.
  • Ensure the integration instance has network access to https://external.threatmonit.io.
  • Review Cortex XSOAR logs for additional error context.

Support

This is a community-supported integration. For issues or feature requests:

Author

ThreatMon Security Intelligence Team
Website: https://www.threatmon.io
Support: integration@threatmonit.io

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

  • Fetch incidents

</~PLATFORM>

Configuration parameters

  • url — API URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • lastIncidentId — Last Incident ID (for initial fetch)
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • fetchInterval — Fetch Interval (minutes)
  • incidentFetchInterval — Incidents Fetch Interval

Commands (5)

  • threatmon_list_cves

    Retrieves a paginated list of all CVEs monitored by ThreatMon.

  • threatmon_list_subscribed_cves

    Retrieves a paginated list of CVEs affecting products that the authenticated company (or a specified child customer) is actively subscribed to.

  • threatmon_request_data_removal

    Submits a Black Market Monitoring data removal request for a specific ThreatMon finding. Requires the company to have remaining Black Market Data Removal credits. Returns 403 if the quota is exceeded or rights are insufficient.

  • threatmon_request_takedown

    Submits a takedown request for a specific Threatmon finding. Eligible finding types include Phishing Domain Detected, Rogue Mobile App Detected, Fake SM Account Detected, and similar alarm types.

  • threatmon_update_incident_status

    Update Incident Status endpoint allows you to change/update status. of specified Threatmon incidents.

Source

ThreatMon.py ThreatMon.yml ThreatMon_description.md
Download History Raw 
## Threatmon Integration

The Threatmon integration allows Cortex XSOAR to connect with the Threatmon platform to automatically retrieve and update incident data. This integration is designed to help security teams streamline incident management workflows by synchronizing Threatmon alarms and their status directly into XSOAR.

### Use Cases
- Automatically fetch and ingest Threatmon alarms as XSOAR incidents.
- Update the status of Threatmon incidents from within XSOAR.
- Submit takedown requests for eligible findings (Phishing Domains, Rogue Mobile Apps, Fake Social Media Accounts).
- Request data removal for Black Market Monitoring findings directly from XSOAR playbooks.
- Maintain a consistent incident lifecycle between Threatmon and XSOAR.

### Key Features
- Fetch Threatmon alarms into Cortex XSOAR.
- Update the status of existing Threatmon incidents (e.g., Open, In Progress, Resolved).
- Submit takedown requests for eligible threat findings.
- Submit Black Market Monitoring data removal requests — checks company credit rights and returns an appropriate error if the quota is exceeded.
- Query all CVEs monitored by ThreatMon, including CVSS v2, v3, v3.1, and v4 scores.
- Query CVEs affecting products the company is subscribed to.
- Supports automated playbooks for streamlined response.

### Commands
- **threatmon_update_incident_status** — Update the status of a specific Threatmon incident using its unique ID.
- **threatmon_request_takedown** — Submit a takedown request for an eligible Threatmon finding.
- **threatmon_request_data_removal** — Submit a Black Market Monitoring data removal request for a specific finding.
- **threatmon_list_cves** — Retrieve a paginated list of all CVEs monitored by ThreatMon.
- **threatmon_list_subscribed_cves** — Retrieve CVEs affecting products the company is subscribed to.

### Requirements
- Threatmon API credentials (API key).
- Access to Threatmon’s external API endpoints.
- For data removal: the authenticated company must have remaining Black Market Data Removal credits.

### Additional Information
Threatmon is a threat intelligence and monitoring platform that provides actionable alerts to security teams. Integrating Threatmon with XSOAR enables more efficient triage, faster response times, and better visibility into your security operations.

For more information about Threatmon, visit: [https://www.threatmon.io](https://www.threatmon.io)

---

**Support**
For support, please contact the Threatmon team at: [integration@threatmonit.io](mailto:integration@threatmonit.io)