ThreatQ v2

A threat intelligence platform that collects and interprets intelligence data from open sources and manages indicator scoring, types, and attributes.

Data Enrichment & Threat Intelligence · ThreatQ

Configuration parameters

  • serverUrl — ThreatQ server URL (e.g. https://192.168.1.136) (required)
  • client_id — ThreatQ client ID (required)
  • credentials — Email (required)
  • threshold — Indicator threshold (minimum TQ score to consider the indicator malicious).
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (32)

  • domain

    Checks the reputation of a domain in ThreatQ.

  • email

    Checks the reputation of an email in ThreatQ.

  • file

    Checks the reputation of a file in ThreatQ.

  • ip

    Checks the reputation of an IP address in ThreatQ.

  • threatq-add-attribute

    Adds an attribute to an object in ThreatQ.

  • threatq-add-source

    Adds a source to an object in ThreatQ.

  • threatq-advanced-search Deprecated

    Runs an advanced indicator search.

  • threatq-create-adversary

    Creates a new adversary in ThreatQ.

  • threatq-create-event

    Creates a new event in ThreatQ.

  • threatq-create-indicator

    Creates a new indicator in ThreatQ.

  • threatq-delete-attribute

    Deletes an attribute from an object in ThreatQ.

  • threatq-delete-object

    Deletes an object in ThreatQ.

  • threatq-delete-source

    Deletes a source from an object in ThreatQ.

  • threatq-download-file

    Downloads a file from ThreatQ to Demisto.

  • threatq-edit-adversary

    Updates an adversary name in ThreatQ.

  • threatq-edit-event

    Updates an event in ThreatQ.

  • threatq-edit-indicator

    Updates an indicator in ThreatQ.

  • threatq-get-all-adversaries

    Returns all adversaries in ThreatQ.

  • threatq-get-all-events

    Retrieves all events in ThreatQ.

  • threatq-get-all-indicators

    Retrieves all indicators in ThreatQ.

  • threatq-get-related-adversaries

    Retrieve related adversaries from an object in ThreatQ.

  • threatq-get-related-events

    Retrieves related events of an object in ThreatQ.

  • threatq-get-related-indicators

    Retrieves related indicators for an object in ThreatQ.

  • threatq-link-objects

    Links two objects together in ThreatQ.

  • threatq-modify-attribute

    Modifies an attribute for an object in ThreatQ.

  • threatq-search-by-id

    Searches for an object by object type and ID. Generic and DBotScore contexts also may be generated.

  • threatq-search-by-name

    Searches for objects by name in the ThreatQ repository.

  • threatq-unlink-objects

    Unlinks two objects in ThreatQ.

  • threatq-update-score

    Modifies an indicator's score in ThreatQ. The final indicator score is the highest of the manual and generated scores.

  • threatq-update-status

    Updates an indicator status in ThreatQ.

  • threatq-upload-file

    Uploads a file in ThreatQ.

  • url

    Checks the reputation of a URL in ThreatQ.