ThreatConnect Tip 2.3.1
- 22 Jan 2023
- 2 Minutes to read
- DarkLight
- PDF
ThreatConnect Tip 2.3.1
- Updated on 22 Jan 2023
- 2 Minutes to read
- DarkLight
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
tags: python | Indicator Enrichment | Threat Intelligence Platform | Cyber Risk Quantification
Description
Integration with the Threat Connect Threat Intelligence Platform (TIP) is created to support CDC users by providing the enrichments consisting of IOCs and other Threat Intelligence related information. This enables CDC users to make informed decisions regarding incident response.
The TIP centralizes and operationalizes thousands of sources of intelligence for streamlined investigation and faster threat blocking. IOCs and other threat indicators are enriched using digital assets and prioritized by severity, bringing context and clarity to threat feeds. It helps by finding and using relevant intelligence, measuring risk based on current known vulnerabilities, and using threat intelligence for detection.
This integration was completed with the help of the Threat Connect - TcEX framework, which enables easily accessing information from the Threat Connect platform, versus with usual APIs.
We use custom adaptive cards to display large amount of threat data in a meaningful intuitive GUI, to facilitate the easy understanding of complex threat intelligence data.
We have provided a single CLI command to cater to different parameters. Users only need to change the parameters, and corresponding results will be shown in a custom Adaptive card. Moreover, with the help of auto enrichment, similar threat intelligence information is also made available as observables.
| Integration Type: | Threat Intelligence Enrichment |
| Information Enriched: | Threat Intelligence information for parameters like IP Address / URL / Hash values, etc. |
| API Supported: | TcEX framework based on RestAPI. |
| Input: | One of the parameters from the following list ( "Address", "File", "Url", "Host", "EmailAddress", "ASN", "CIDR", "Mutex", "Registry Key", "User Agent.) |
| Output: | Detailed enrichment consisting of IOCs and other threat indicators related information of provided Input parameters. |
Customer Configuration
No customer configuration
CDC Command Lines
* **enrich_indicator_by_tc_id_cli**
This CLi provides the capability to enrich the indicator/observable related information from ThreatConnect TIP, for the specified observable or threatconnect id (tc_id) - provided as a parameter in the CLI.
| Option | Type | Description | Required |
|---|---|---|---|
| ioc | Any | observable data or TC ID. | True |
* **enrich_pre_define_indicator_cli**
This CLI provides the capability to enrich the indicator-related information from ThreatConnect TIP for the specific indicator type and value provided as a parameter in the CLI.
| Option | Type | Description | Required |
|---|---|---|---|
| indicator_value | string | indicator value for various indicator type. | True |
| indicator_type | string | Indicator value from Address, URL, EmailAddress, File, Host, User Agent, Registry Key, Mutex, ASN and CIDR | True |
Workflows
* **enrich_by_id_workflow**
Enrich by ID workflow
Rules
No rules
Sensors
No sensors
Triggers
No triggers
Known Issues
No known issues
Was this article helpful?