Contents x
      ThreatConnect Tip 2.3.1
      • 22 Jan 2023
      • 2 Minutes to read
      • Dark
        Light
      • PDF
      Contents

      ThreatConnect Tip 2.3.1

      • Updated on 22 Jan 2023
      • 2 Minutes to read
      • Dark
        Light
      • PDF
      Article Summary

      tags: python | Indicator Enrichment | Threat Intelligence Platform | Cyber Risk Quantification

      Description

      Integration with the Threat Connect Threat Intelligence Platform (TIP) is created to support CDC users by providing the enrichments consisting of IOCs and other Threat Intelligence related information. This enables CDC users to make informed decisions regarding incident response.

      The TIP centralizes and operationalizes thousands of sources of intelligence for streamlined investigation and faster threat blocking. IOCs and other threat indicators are enriched using digital assets and prioritized by severity, bringing context and clarity to threat feeds. It helps by finding and using relevant intelligence, measuring risk based on current known vulnerabilities, and using threat intelligence for detection.

      This integration was completed with the help of the Threat Connect - TcEX framework, which enables easily accessing information from the Threat Connect platform, versus with usual APIs.

      We use custom adaptive cards to display large amount of threat data in a meaningful intuitive GUI, to facilitate the easy understanding of complex threat intelligence data.

      We have provided a single CLI command to cater to different parameters. Users only need to change the parameters, and corresponding results will be shown in a custom Adaptive card. Moreover, with the help of auto enrichment, similar threat intelligence information is also made available as observables.

      Integration Type:Threat Intelligence Enrichment
      Information Enriched:Threat Intelligence information for parameters like IP Address / URL / Hash values, etc.
      API Supported:TcEX framework based on RestAPI.
      Input:One of the parameters from the following list ( "Address", "File", "Url", "Host", "EmailAddress", "ASN", "CIDR", "Mutex", "Registry Key", "User Agent.)
      Output:Detailed enrichment consisting of IOCs and other threat indicators related information of provided Input parameters.

      Customer Configuration

      No customer configuration

      CDC Command Lines

      * **enrich_indicator_by_tc_id_cli**
      This CLi provides the capability to enrich the indicator/observable related information from ThreatConnect TIP, for the specified observable or threatconnect id (tc_id) - provided as a parameter in the CLI.

      OptionTypeDescriptionRequired
      iocAnyobservable data or TC ID.True

      * **enrich_pre_define_indicator_cli**
      This CLI provides the capability to enrich the indicator-related information from ThreatConnect TIP for the specific indicator type and value provided as a parameter in the CLI.

      OptionTypeDescriptionRequired
      indicator_valuestringindicator value for various indicator type.True
      indicator_typestringIndicator value from Address, URL, EmailAddress, File, Host, User Agent, Registry Key, Mutex, ASN and CIDRTrue

      Workflows

      * **enrich_by_id_workflow**
      Enrich by ID workflow

      Rules

      No rules

      Sensors

      No sensors

      Triggers

      No triggers

      Known Issues

      No known issues

      Was this article helpful?
      What's Next