ThreatConnect v3

ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.

Category

Data Enrichment & Threat Intelligence

Pack

ThreatConnect

Configuration parameters

• baseUrl — Base Url (required)
• accessId — Access ID
• api_secret_key — Access ID (required)
• defaultOrg — Default Organization
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• first_fetch — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
• max_fetch — Maximum number of incidents to fetch
• incidentType — Incident type
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• tags — Tags filter for the fetch
• group_type — Group Type filter for the fetch
• status — Status filter for the fetch
• tql_filter — TQL Filter
• fields — Incident Metadata
• integrationReliability — Source Reliability (required)
• rating — Rating Threshold for Malicious Indicators
• confidence — Confidence Threshold for Malicious Indicators
• freshness — Indicator Reputation Freshness in days

Commands (55)

• domain — Searches for an indicator of type domain.
• file — Searches for an indicator of type file.
• ip — Searches for an indicator of type IP address.
• tc-add-group-attribute — Deprecated. Use the tc-update-group command.
• tc-add-group-security-label — Deprecated. Use the tc-update-group command.
• tc-add-group-tag — Adds tags to a specified group.
• tc-add-indicator — Adds a new indicator to ThreatConnect.
• tc-associate-group-to-group — Deprecated. Use the tc-update-group command.
• tc-create-campaign — Creates a group based on the Campaign type.
• tc-create-document-group — Creates a document group.
• tc-create-event — Creates a group based on the Event type.
• tc-create-incident — Creates a new incident group.
• tc-create-threat — Creates a group based on the "Threats" type.
• tc-create-victim — Creates a victim.
• tc-create-victim-asset — Creates a victim asset.
• tc-create-victim-attribute — Creates a victim attribute.
• tc-delete-group — Deletes a group.
• tc-delete-indicator — Deletes an indicator from ThreatConnect.
• tc-delete-indicator-tag — Removes a tag from a specified indicator.
• tc-delete-victim — Deletes a victim.
• tc-delete-victim-asset — Deletes a victim asset.
• tc-delete-victim-attribute — Deletes a victim attribute.
• tc-download-document — Downloads the contents of a document.
• tc-download-report — The group report to download in PDF format.
• tc-fetch-incidents — Deprecated. Use the tc-list-groups command.
• tc-get-associated-groups — Returns groups associated with a specified group.
• tc-get-events — Returns a list of events.
• tc-get-group — Deprecated. Use the tc-list-groups command.
• tc-get-group-attributes — Deprecated. Use the tc-list-groups command.
• tc-get-group-indicators — Deprecated. Use the tc-list-groups command.
• tc-get-group-security-labels — Deprecated. Use the tc-list-groups command.
• tc-get-group-tags — Deprecated. Use the tc-list-groups command.
• tc-get-groups — Deprecated. Use the tc-list-groups command.
• tc-get-incident-associate-indicators — Returns indicators that are related to a specific incident.
• tc-get-indicator — Retrieves information about an indicator.
• tc-get-indicator-owners — Get the owner for an indicator.
• tc-get-indicator-types — Returns all indicator types available.
• tc-get-indicators-by-tag — Fetches all indicators that have a tag.
• tc-get-tags — Returns a list of all ThreatConnect tags.
• tc-group-associate-indicator — Deprecated. Use the tc-update-group command.
• tc-incident-associate-indicator — Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.
• tc-indicators — Retrieves a list of all indicators.
• tc-list-attribute-type — Retrieved all attribute types.
• tc-list-groups — Returns all groups.
• tc-list-victim-assets — Retrieves victim assets.
• tc-list-victim-attributes — Retrieves victim attributes.
• tc-list-victims — Retrieves victims.
• tc-owners — Retrieves all owners for the current account.
• tc-tag-indicator — Adds a tag to an existing indicator.
• tc-update-group — Updates a group.
• tc-update-indicator — Updates the indicator in ThreatConnect.
• tc-update-victim — Updates a victim.
• tc-update-victim-asset — Updates a victim asset.
• tc-update-victim-attribute — Updates a victim attribute.
• url — Searches for an indicator of type URL.