ThreatConnect Intelligence

The ThreatConnect Intelligence connector facilitates the interaction with ThreatConnect's suite of threat intelligence tools, enabling users to automate actions related to indicators, attributes, and tags.

ThreatConnect Intelligence is a robust threat intelligence platform that provides comprehensive data on indicators of compromise (IOCs) and adversaries. This connector enables Swimlane Turbine users to integrate real-time threat intelligence into their security workflows, allowing for the automation of indicator management, enrichment, and analysis. By leveraging ThreatConnect's detailed threat ratings, attributes, and tags, security teams can enhance incident response, streamline threat hunting, and improve overall security posture with actionable insights.

Prerequisites

To effectively utilize the ThreatConnect Intelligence connector with Swimlane Turbine, ensure you have the following:

HMAC authentication with the necessary parameters:

URL: Endpoint for ThreatConnect API access

Access Key: Unique identifier for API access

Secret Key: Confidential key paired with the Access Key for secure authentication

Capabilities

The ThreatConnect connector provides the following capabilities:

Add Indicator False Positive

Create Indicator Attributes

Create Indicator Threat and Confidence Ratings

Fetch all Indicators

Get Indicators

Get Indicators by Incident ID

Get Tags by Incident ID

Update Indicator Attributes

Tasks Setup

Fetch all Indicators

If we do not pass any indicator type , this action will fetch all the indicators.

To check all the possible values of indicator types click here!

Notes

If using an API user account on ThreatConnect’s Public Cloud instance, the ThreatConnect API is accessible at https://app.threatconnect.com/api. If using an API user account on a Dedicated Cloud or On-Premises ThreatConnect instance, the ThreatConnect API is accessible at the base URL of your instance followed by /api (e.g., https://companyabc.threatconnect.com/api).

ThreatConnect API Documentation

Create An API User

Configurations

ThreatConnect HMAC

Authenticates using HMAC

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
access_key	Access Key	string	Required
secret_key	Secret Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Indicator False Positive

Marks an indicator as a false positive in ThreatConnect Intelligence, specifying the indicator type and value.

Endpoint

URL: /api/v2/indicators/{{indicatorType}}/{{indicator}}/falsePositive

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.indicatorType	string	Required	Type of the Indicator.
path_parameters.indicator	string	Required	Specific Indicator Value.

Input Example

{"path_parameters":{"indicatorType":"hosts","indicator":"example.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.falsePositive	object	Response data
data.falsePositive.count	number	Response data
data.falsePositive.lastReported	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"Success","data":{"falsePositive":{}}}}

Create Indicator Attributes

Adds custom attributes to a specified indicator in ThreatConnect Intelligence, using type and value for precise targeting.

Endpoint

URL: /api/v2/indicators/{{indicatorType}}/{{indicator}}/attributes

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.indicatorType	string	Required	Type of the Indicator.
path_parameters.indicator	string	Required	Specific Indicator Value.
type	string	Optional	Type of the Attribute.
value	string	Optional	Value of the Attribute.
displayed	boolean	Optional	Whether Attribute is displayed.

Input Example

{"json_body":{"type":"Description","value":"This is a test description.","displayed":true},"path_parameters":{"indicatorType":"emailAddresses","indicator":"[email protected]"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.attribute	object	Response data
data.attribute.id	string	Response data
data.attribute.type	string	Response data
data.attribute.dateAdded	string	Response data
data.attribute.lastModified	string	Response data
data.attribute.displayed	boolean	Response data
data.attribute.value	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"Success","data":{"attribute":{}}}}

Create Indicator Threat and Confidence Ratings

Create threat and confidence ratings for a specified indicator type in ThreatConnect Intelligence, requiring a 'type' in the JSON body.

Endpoint

URL: /api/v3/indicators?fields=associatedGroups&fields=attributes&fields=securityLabels&fields=tags

Method: POST

Input

Argument Name	Type	Required	Description
active	boolean	Optional	Indicates whether the Indicator is active.
activeLocked	boolean	Optional	Indicates whether the active Indicator Status is locked.
associatedArtifacts	object	Optional	A list of Artifacts associated to the Indicator.
associatedArtifacts.data	array	Optional	Response data
associatedArtifacts.data.id	number	Optional	Artifact ID.
associatedArtifacts.data.caseId	number	Optional	The ID of the Case to which the Artifact belongs.
associatedArtifacts.data.summary	string	Optional	The summary (i.e., name) of the Artifact.
associatedArtifacts.data.type	string	Optional	The Artifact's type.
associatedCases	object	Optional	A list of Cases associated to the Indicator.
associatedCases.data	array	Optional	Response data
associatedCases.data.id	number	Optional	Case ID.
associatedCases.data.name	string	Optional	The name of the Case.
associatedCases.data.status	string	Optional	The status of the Case.
associatedCases.data.severity	string	Optional	The severity of the Case.
associatedGroups	object	Optional	A list of Groups associated to the Indicator.
associatedGroups.data	array	Optional	Response data
associatedGroups.data.id	number	Optional	Group ID.
associatedGroups.data.name	string	Optional	The Group's name.
associatedGroups.data.type	string	Optional	The type of Group.
associatedGroups.data.ownerName	string	Optional	The name of the owner to which the Group belongs.
associatedIndicators	object	Optional	A list of Indicators associated to the Indicator.
associatedIndicators.data	array	Optional	Response data
associatedIndicators.data.id	number	Optional	Indicator ID.
associatedIndicators.data.hostName	string	Optional	The host name associated with the Host Indicator.
associatedIndicators.data.type	string	Optional	The type of Indicator.

Input Example

{"json_body":{"type":"Host","hostName":"ultrabadguy.com","dnsActive":true,"whoisActive":true,"active":true,"associatedGroups":{"data":[{"id":12},{"name":"Bad Guy","type":"Adversary","ownerName":"Demo Source"}]},"attributes":{"data":[{"type":"Description","value":"This host is very dangerous","default":true}]},"confidence":85,"rating":5,"securityLabels":{"data":[{"name":"TLP:AMBER"}]},"tags":{"data":[{"name":"Targeted Attack"},{"techniqueId":"T1566"}]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.ownerId	number	Response data
data.ownerName	string	Response data
data.dateAdded	string	Response data
data.webLink	string	Response data
data.type	string	Response data
data.lastModified	string	Response data
data.rating	number	Response data
data.confidence	number	Response data
data.description	string	Response data
data.summary	string	Response data
data.privateFlag	boolean	Response data
data.active	boolean	Response data
data.activeLocked	boolean	Response data
data.hostName	string	Response data
data.dnsActive	boolean	Response data
data.whoisActive	boolean	Response data
data.legacyLink	string	Response data
message	string	Response message
status	string	Status value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"id":4,"ownerId":1,"ownerName":"Demo Organization","dateAdded":"2021-11-05T16:43:17Z","webLink":"https://app.threatconnect.com/#/details/indicators/4/overview","type":"Host","lastModified":"2021-11-05T16:43:17Z","rating":5,"confidence":85,"description":"This host is very dangerous","summary":"ultrabadguy.com","privateFlag":false,"active":true,"activeLocked":false,"hostName":"ultrabadguy.com"},"message":"Created","status"...

Get All Indicators

Retrieve all indicators of a specified type from ThreatConnect Intelligence using the 'type' path parameter.

Endpoint

URL: /api/v2/indicators/{{type}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.type	string	Required	Parameters for the Get All Indicators action

Input Example

{"path_parameters":{"type":"hosts"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.resultCount	number	Response data
data.indicator	array	Response data
data.indicator.id	number	Response data
data.indicator.ownerName	string	Response data
data.indicator.type	string	Response data
data.indicator.dateAdded	string	Response data
data.indicator.lastModified	string	Response data
data.indicator.threatAssessRating	number	Response data
data.indicator.threatAssessConfidence	number	Response data
data.indicator.threatAssessScore	number	Response data
data.indicator.calScore	number	Response data
data.indicator.calIndicatorStatus	number	Response data
data.indicator.webLink	string	Response data
data.indicator.summary	string	Response data
data.indicator.communityOrSource	boolean	Response data
data.indicator.additionalOwners	array	Response data

Output Example

{"status":"active","data":{"resultCount":123,"indicator":[{}]}}

Get Indicator

Retrieves detailed information for a specified indicator type and value from ThreatConnect Intelligence.

Endpoint

URL: /api/v2/indicators/{{type}}/{{value}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.type	string	Required	Parameters for the Get Indicator action
path_parameters.value	string	Required	Parameters for the Get Indicator action

Input Example

{"path_parameters":{"type":"emailAddresses","value":"[email protected]"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.address	object	Response data
data.address.id	number	Response data
data.address.owner	object	Response data
data.address.owner.id	number	Response data
data.address.owner.name	string	Response data
data.address.owner.type	string	Response data
data.address.dateAdded	string	Response data
data.address.lastModified	string	Response data
data.address.threatAssessRating	number	Response data
data.address.threatAssessConfidence	number	Response data
data.address.threatAssessScore	number	Response data
data.address.calScore	number	Response data
data.address.calIndicatorStatus	number	Response data
data.address.webLink	string	Response data
data.address.communityOrSource	boolean	Response data
data.address.additionalOwners	array	Response data
data.address.additionalOwners.file_name	string	Response data
data.address.additionalOwners.file	string	Response data
data.address.ip	string	Response data

Output Example

{"status":"active","data":{"address":{"id":123,"owner":{},"dateAdded":"string","lastModified":"string","threatAssessRating":123,"threatAssessConfidence":123,"threatAssessScore":123,"calScore":123,"calIndicatorStatus":123,"webLink":"string","communityOrSource":true,"additionalOwners":[],"ip":"string"}}}

Get Indicators by Incident ID

Retrieve indicators associated with a specific incident ID from ThreatConnect Intelligence using the required path parameter.

Endpoint

URL: /api/v2/groups/incidents/{{incident_id}}/indicators

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Get Indicators by Incident ID action

Input Example

{"path_parameters":{"incident_id":67360}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.resultCount	number	Response data
data.indicator	array	Response data
data.indicator.id	number	Response data
data.indicator.ownerName	string	Response data
data.indicator.type	string	Response data
data.indicator.dateAdded	string	Response data
data.indicator.lastModified	string	Response data
data.indicator.rating	number	Response data
data.indicator.confidence	number	Response data
data.indicator.threatAssessRating	number	Response data
data.indicator.threatAssessConfidence	number	Response data
data.indicator.threatAssessScore	number	Response data
data.indicator.calScore	number	Response data
data.indicator.calIndicatorStatus	number	Response data
data.indicator.webLink	string	Response data
data.indicator.description	string	Response data
data.indicator.summary	string	Response data
data.indicator.communityOrSource	boolean	Response data
data.indicator.additionalOwners	array	Response data

Output Example

{"status":"active","data":{"resultCount":123,"indicator":[{}]}}

Get Tags

Retrieves tags associated with a given incident ID in ThreatConnect Intelligence for enhanced categorization and analysis.

Endpoint

URL: /api/v2/groups/incidents/{{incident_id}}/tags

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Get Tags action

Input Example

{"path_parameters":{"incident_id":67360}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.resultCount	number	Response data
data.tag	array	Response data
data.tag.name	string	Response data
data.tag.webLink	string	Response data

Output Example

{"status":"active","data":{"resultCount":123,"tag":[{}]}}

Update Indicator Attributes

Updates an indicator's attributes in ThreatConnect Intelligence, specifying type, identifier, attribute ID, and new value.

Endpoint

URL: /api/v2/indicators/{{indicatorType}}/{{indicator}}/attributes/{{attributeId}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.indicatorType	string	Required	Type of the Indicator.
path_parameters.indicator	string	Required	Specific Indicator Value.
path_parameters.attributeId	string	Required	ID of the Attribute.
value	string	Optional	New Value for the Attribute.
displayed	boolean	Optional	Whether Attribute is displayed.
source	string	Optional	Source of the Attribute.

Input Example

{"json_body":{"value":"Updated Description.","displayed":true,"source":"Updated Source"},"path_parameters":{"indicatorType":"emailAddresses","indicator":"[email protected]","attributeId":"54321"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
data	object	Response data
data.attribute	object	Response data
data.attribute.id	string	Response data
data.attribute.type	string	Response data
data.attribute.dateAdded	string	Response data
data.attribute.lastModified	string	Response data
data.attribute.displayed	boolean	Response data
data.attribute.value	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"Success","data":{"attribute":{}}}}

Response Headers

Header	Description	Example
Access-Control-Allow-Methods	HTTP response header: Access-Control-Allow-Methods
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin
Cache-Control	Directives for caching mechanisms
Connection	HTTP response header: Connection
Content-Encoding	HTTP response header: Content-Encoding
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
Pragma	HTTP response header: Pragma
Server	Information about the software used by the origin server
Set-Cookie	HTTP response header: Set-Cookie
Strict-Transport-Security	HTTP response header: Strict-Transport-Security
Transfer-Encoding	HTTP response header: Transfer-Encoding
X-Content-Type-Options	HTTP response header: X-Content-Type-Options
X-Frame-Options	HTTP response header: X-Frame-Options
X-XSS-Protection	HTTP response header: X-XSS-Protection