ThreatQ v2

A threat intelligence platform that collects and interprets intelligence data from open sources and manages indicator scoring, types, and attributes.

Category

Data Enrichment & Threat Intelligence

Pack

ThreatQ

Configuration parameters

• serverUrl — ThreatQ server URL (e.g. https://192.168.1.136) (required)
• client_id — ThreatQ client ID (required)
• credentials — Email (required)
• threshold — Indicator threshold (minimum TQ score to consider the indicator malicious).
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• integrationReliability — Source Reliability
• feedExpirationPolicy —
• feedExpirationInterval —

Commands (32)

• domain — Checks the reputation of a domain in ThreatQ.
• email — Checks the reputation of an email in ThreatQ.
• file — Checks the reputation of a file in ThreatQ.
• ip — Checks the reputation of an IP address in ThreatQ.
• threatq-add-attribute — Adds an attribute to an object in ThreatQ.
• threatq-add-source — Adds a source to an object in ThreatQ.
• threatq-advanced-search — Runs an advanced indicator search.
• threatq-create-adversary — Creates a new adversary in ThreatQ.
• threatq-create-event — Creates a new event in ThreatQ.
• threatq-create-indicator — Creates a new indicator in ThreatQ.
• threatq-delete-attribute — Deletes an attribute from an object in ThreatQ.
• threatq-delete-object — Deletes an object in ThreatQ.
• threatq-delete-source — Deletes a source from an object in ThreatQ.
• threatq-download-file — Downloads a file from ThreatQ to Demisto.
• threatq-edit-adversary — Updates an adversary name in ThreatQ.
• threatq-edit-event — Updates an event in ThreatQ.
• threatq-edit-indicator — Updates an indicator in ThreatQ.
• threatq-get-all-adversaries — Returns all adversaries in ThreatQ.
• threatq-get-all-events — Retrieves all events in ThreatQ.
• threatq-get-all-indicators — Retrieves all indicators in ThreatQ.
• threatq-get-related-adversaries — Retrieve related adversaries from an object in ThreatQ.
• threatq-get-related-events — Retrieves related events of an object in ThreatQ.
• threatq-get-related-indicators — Retrieves related indicators for an object in ThreatQ.
• threatq-link-objects — Links two objects together in ThreatQ.
• threatq-modify-attribute — Modifies an attribute for an object in ThreatQ.
• threatq-search-by-id — Searches for an object by object type and ID. Generic and DBotScore contexts also may be generated.
• threatq-search-by-name — Searches for objects by name in the ThreatQ repository.
• threatq-unlink-objects — Unlinks two objects in ThreatQ.
• threatq-update-score — Modifies an indicator's score in ThreatQ. The final indicator score is the highest of the manual and generated scores.
• threatq-update-status — Updates an indicator status in ThreatQ.
• threatq-upload-file — Uploads a file in ThreatQ.
• url — Checks the reputation of a URL in ThreatQ.