ThreatConnect v2

Deprecated. Use the ThreatConnect v3 integration instead.

Category

Data Enrichment & Threat Intelligence

Pack

ThreatConnect

Configuration parameters

• baseUrl — Base Url (required)
• accessId — Access ID (required)
• secretKey — Secret Key (required)
• defaultOrg — Default Organization
• integrationReliability — Source Reliability (required)
• rating — Rating threshold for Malicious Indicators
• confidence — Confidence threshold for Malicious Indicators
• freshness — Indicator Reputation Freshness (in days)
• proxy — Use system proxy settings

Commands (40)

• domain — Searches for an indicator of type domain.
• file — Searches for an indicator of type file.
• ip — Searches for an indicator of type IP address.
• tc-add-group-attribute — Adds an attribute to a specified group.
• tc-add-group-security-label — Adds a security label to a group.
• tc-add-group-tag — Adds tags to a specified group.
• tc-add-indicator — Adds a new indicator to ThreatConnect.
• tc-associate-group-to-group — Associates one group with another group.
• tc-create-campaign — Creates a group based on the "Campaign" type.
• tc-create-document-group — Creates a document group.
• tc-create-event — Creates a group based on the "Event" type.
• tc-create-incident — Creates a new incident group.
• tc-create-threat — Creates a group based on the "Threats" type.
• tc-delete-group — Deletes a group.
• tc-delete-indicator — Deletes an indicator from ThreatConnect.
• tc-delete-indicator-tag — Removes a tag from a specified indicator.
• tc-download-document — Downloads the contents of a document.
• tc-download-report — The group report to download in PDF format.
• tc-fetch-incidents — Fetches incidents from ThreatConnect.
• tc-get-associated-groups — Returns indicators associated with a specified group.
• tc-get-events — Returns a list of events.
• tc-get-group — Retrieves a single group.
• tc-get-group-attributes — Retrieves the attribute of a group.
• tc-get-group-indicators — Returns indicators associated with a group.
• tc-get-group-security-labels — Retrieves the security labels of a group.
• tc-get-group-tags — Retrieves the tags of a group.
• tc-get-groups — Returns all groups, filtered by the group type.
• tc-get-incident-associate-indicators — Returns indicators that are related to a specific incident.
• tc-get-indicator — Retrieves information about an indicator.
• tc-get-indicator-owners — Get Owner for Indicator
• tc-get-indicator-types — Returns all indicator types available.
• tc-get-indicators-by-tag — Fetches all indicators that have a tag.
• tc-get-tags — Returns a list of all ThreatConnect tags.
• tc-group-associate-indicator — Associates an indicator with a group.
• tc-incident-associate-indicator — Associates an indicator with an existing incident. The indicator must exist before running this command. To add an indicator, run the tc-add-indicator command.
• tc-indicators — Retrieves a list of all indicators.
• tc-owners — Retrieves all owners for the current account.
• tc-tag-indicator — Adds a tag to an existing indicator.
• tc-update-indicator — Updates the indicator in ThreatConnect.
• url — Searches for an indicator of type URL.