ThreatQuotient ThreatQ

The ThreatQuotient ThreatQ connector facilitates the automation of threat intelligence operations by enabling seamless integration with the ThreatQ platform.

ThreatQuotient ThreatQ is a threat intelligence platform that aggregates, correlates, and analyzes threat data to provide actionable insights. This connector enables Swimlane Turbine users to automate the ingestion and management of threat intelligence, streamline event and indicator handling, and enhance security operations with enriched data. By integrating with ThreatQuotient ThreatQ, users can create and manage events, indicators, and import sessions, as well as perform detailed searches and updates, all within the Swimlane Turbine environment.

Prerequisites

Before integrating ThreatQuotient ThreatQ with Swimlane Turbine, ensure you have the following:

OAuth 2.0 authentication credentials with the following parameters:

URL: The endpoint URL for ThreatQ API access

API User Email: The email associated with your ThreatQ account

Client Password: Your password for OAuth client authentication

OAuth Client ID: The client ID provided by ThreatQ for OAuth setup

API Type: The specific API type or version supported by ThreatQ

Capabilities

The ThreatQuotient Connector has the following capabilities:

Create Event

Create Indicators List

Delete Import Indicator

Get Event List

Get Indicators List

Get Indicator by ID

Import Events

Indicator Search

Indicator Search with Value

Indicators Query

Update Import Indicator

Additional Documentation

ThreatQuotient ThreatQ Connector Documentation

ThreatQuotient ThreatQ API Documentation

ThreatQuotient ThreatQ Authentication Guide

Configurations

Oauth Password Grant

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
email	The username for authentication	string	Required
password	The password for authentication	string	Required
clientId	Client ID of ThreatQ OAuth	string	Required
api_type	Authentication is different for standard and beta versions of Threatq API	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Event

Initiates the creation of a new event in ThreatQuotient ThreatQ using provided JSON body data.

Endpoint

URL: api/events

Method: POST

Input

Argument Name	Type	Required	Description
title	string	Optional	Parameter for Create Event
type	string	Optional	Type of the resource
happened_at	string	Optional	Parameter for Create Event
sources	array	Optional	Parameter for Create Event
sources.name	string	Optional	Name of the resource
sources.tlp	object	Optional	Parameter for Create Event
sources.tlp.name	string	Optional	Name of the resource

Input Example

{"json_body":{"title":"Event Name","type":"Spearphish","happened_at":"2017-03-20 01:43:05","sources":[{"name":"Event Source","tlp":{"name":"AMBER"}}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.title	string	Response data
data.type_id	number	Response data
data.happened_at	string	Response data
data.hash	string	Response data
data.updated_at	string	Response data
data.created_at	string	Response data
data.id	number	Response data
data.type	object	Response data
data.type.id	number	Response data
data.type.name	string	Response data
data.type.user_editable	string	Response data
data.type.created_at	string	Response data
data.type.updated_at	string	Response data
data.sources	array	Response data
data.sources.type	string	Response data
data.sources.name	string	Response data
data.sources.updated_at	string	Response data
data.sources.created_at	string	Response data
data.sources.id	number	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"title":"Event Name","type_id":1,"happened_at":"2017-03-20 01:43:05","hash":"e59c3274f3156b10aca1c8962a5880cb","updated_at":"2017-03-20 13:35:13","created_at":"2017-03-20 13:35:13","id":601,"type":{},"sources":[]}}}

Create Indicators List

Generates a new list of indicators in ThreatQuotient ThreatQ based on the provided JSON body.

Endpoint

URL: api/indicators

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Create Indicators List action
parameters.offset	number	Optional	Parameters for the Create Indicators List action
parameters.sort	string	Optional	Parameters for the Create Indicators List action
parameters.with	string	Optional	Parameters for the Create Indicators List action

Input Example

{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"},"json_body":[{"class":"network","value":"115.47.67.155","type_id":"10","status_id":2,"sources":[{"name":"Source","tlp":{"name":"GREEN"},"published_at":"2016-07-18 02:00:00"}],"attributes":[{"name":"Confidence","value":"High","sources":[{"name":"Source","tlp":{"name":"GREEN"},"published_at":"2016-07-18 02:00:00"}]},{"name":"Port","value":"4000"},{"name":"Scheme","value":"https"}]}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.class	string	Response data
data.hash	string	Response data
data.value	string	Response data
data.last_detected_at	object	Response data
data.expires_at	object	Response data
data.expired_at	object	Response data
data.expires_calculated_at	object	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data
data.existing	string	Response data
data.type	object	Response data
data.type.id	number	Response data
data.type.name	string	Response data
data.type.class	string	Response data
data.type.score	object	Response data
data.type.wildcard_matching	string	Response data
data.type.created_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":1,"data":[{}]}}

Delete Import Indicator

Removes a specific indicator from an import session in ThreatQuotient ThreatQ using the import ID and indicator ID.

Endpoint

URL: api/imports/{{import_id}}/indicators/{{import_indicator_id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.import_id	number	Required	Parameters for the Delete Import Indicator action
path_parameters.import_indicator_id	number	Required	Parameters for the Delete Import Indicator action

Input Example

{"path_parameters":{"import_id":1,"import_indicator_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{},"reason":"OK"}

Get Event List

Retrieve a list of security events from ThreatQuotient ThreatQ with options for filtering and sorting.

Endpoint

URL: api/events

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Event List action
parameters.offset	number	Optional	Parameters for the Get Event List action
parameters.sort	string	Optional	Parameters for the Get Event List action
parameters.with	string	Optional	Parameters for the Get Event List action

Input Example

{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.type_id	number	Response data
data.title	string	Response data
data.description	string	Response data
data.happened_at	string	Response data
data.hash	string	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":600,"data":[{},{},{}]}}

Get Indicator by ID

Retrieve a specific indicator from ThreatQuotient ThreatQ using the unique identifier provided.

Endpoint

URL: api/indicators/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Indicator by ID action
parameters.with	string	Optional	Parameters for the Get Indicator by ID action

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"with":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.class	string	Response data
data.hash	string	Response data
data.value	string	Response data
data.last_detected_at	string	Response data
data.expires_at	object	Response data
data.expired_at	object	Response data
data.expires_calculated_at	object	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 31 Aug 2023 07:33:24 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Server":"Apache","X-Frame-Options":"SAMEORIGIN","Vary":"Authorization","Cache-Control":"no-cache","Content-Security-Policy":"frame-ancestors 'self';","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Set-Cookie":"threatq_api=eyJpdiI6Il...

Get Indicators List

Retrieve a comprehensive list of indicators from ThreatQuotient ThreatQ for analysis and threat intelligence.

Endpoint

URL: api/indicators

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Indicators List action
parameters.offset	number	Optional	Parameters for the Get Indicators List action
parameters.sort	string	Optional	Parameters for the Get Indicators List action
parameters.with	string	Optional	Parameters for the Get Indicators List action

Input Example

{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.class	string	Response data
data.hash	string	Response data
data.value	string	Response data
data.last_detected_at	string	Response data
data.expires_at	object	Response data
data.expired_at	object	Response data
data.expires_calculated_at	object	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":7481,"data":[{},{},{}]}}

Import Events

Retrieve a list of import events from ThreatQuotient ThreatQ using the specified import ID.

Endpoint

URL: api/imports/{{import_id}}/events

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Import Events action
parameters.offset	number	Optional	Parameters for the Import Events action
parameters.sort	string	Optional	Parameters for the Import Events action
parameters.with	string	Optional	Parameters for the Import Events action
path_parameters.import_id	number	Required	Parameters for the Import Events action

Input Example

{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"},"path_parameters":{"import_id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.import_id	number	Response data
data.title	string	Response data
data.description	string	Response data
data.type_id	number	Response data
data.happened_at	string	Response data
data.status_id	number	Response data
data.source	string	Response data
data.whitelisted	string	Response data
data.duplicate	string	Response data
data.type	object	Response data
data.type.id	number	Response data
data.type.name	string	Response data
data.type.user_editable	string	Response data
data.type.created_at	string	Response data
data.type.updated_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"data":[{},{}]}}

Indicator Search

Performs a search for indicators within ThreatQuotient ThreatQ based on criteria specified in the provided JSON body.

Endpoint

URL: api/indicators/query

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Indicator Search action
parameters.offset	number	Optional	Parameters for the Indicator Search action
parameters.sort	string	Optional	Parameters for the Indicator Search action
criteria	object	Optional	Parameter for Indicator Search
criteria.+or	array	Optional	Parameter for Indicator Search
criteria.+or.mentions	string	Optional	Parameter for Indicator Search
criteria.+or.value	object	Optional	Value for the parameter
criteria.+or.value.+contains	string	Optional	Value for the parameter
filters	object	Optional	Parameter for Indicator Search
filters.+and	array	Optional	Parameter for Indicator Search
filters.+and.created_at	object	Optional	Parameter for Indicator Search
filters.+and.created_at.+lt	string	Optional	Parameter for Indicator Search
filters.+and.+or	array	Optional	Parameter for Indicator Search
filters.+and.+or.+and	array	Optional	Parameter for Indicator Search
filters.+and.+or.+and.source_name	string	Optional	Name of the resource
filters.+and.+or.+and.source_created_at	object	Optional	Parameter for Indicator Search
filters.+and.updated_at	object	Optional	Parameter for Indicator Search
filters.+and.updated_at.+lt	string	Optional	Parameter for Indicator Search
filters.+or	array	Optional	Parameter for Indicator Search
filters.+or.attribute	object	Optional	Parameter for Indicator Search
filters.+or.attribute.name	string	Optional	Name of the resource
filters.+or.attribute.value	string	Optional	Value for the parameter

Input Example

{"parameters":{"limit":100,"offset":100,"sort":"id"},"json_body":{"criteria":{"+or":[{"mentions":"org"},{"value":{"+contains":"test.com"}}]},"filters":{"+and":[{"created_at":{"+lt":"2021-01-27 22:35:00"}},{"+or":[{"expires_at":{"+gt":"2021-01-26 23:59:59","+lt":"2021-01-28 00:00:00"}},{"expired_at":{"+gt":"2021-01-26 23:59:59","+lt":"2021-01-28 00:00:00"}}]},{"+or":[{"type_name":"FQDN"}]},{"+or":[{"status_name":"Active"}]},{"+or":[{"cidr_ipv4":"19.34.212.155/8"}]},{"+or":[{"score":{"+gte":6,"+lte":8}}]},{"+or":[{"+and":[{"source_name":"Customer Admin"},{"published_at":{"+lt":"2021-01-27 22:50:00"}}]}]},{"+or":[{"related":{"id":1,"type":"indicator"}}]},{"+or":[{"related":{"object":"adversary"}}]},{"+or":[{"source_name":"Primary Contributor"}]},{"+or":[{"tags":"Internal"}]},{"updated_at":{"+lt":"2021-01-27 22:51:00"}},{"+or":[{"+and":[{"source_name":"Primary Contributor"},{"source_created_at":{"+lt":"2021-01-27 22:50:00"}}]}]}],"+or":[{"attribute":{"name":"Confidence","value":"High"}}]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.class	string	Response data
data.score	number	Response data
data.value	string	Response data
data.expires_calculated_at	string	Response data
data.touched_at	string	Response data
data.id	number	Response data
data.updated_at	string	Response data
data.published_at	string	Response data
data.last_detected_at	string	Response data
data.created_at	string	Response data
data.status_id	number	Response data
data.hash	string	Response data
data.type_id	number	Response data
data.adversaries	array	Response data
data.adversaries.name	string	Response data
data.type	object	Response data
data.type.name	string	Response data
data.type.id	number	Response data
data.type.class	string	Response data
data.status	object	Response data
data.status.name	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"data":[{},{}],"offset":0,"limit":25}}

Indicator Search with Value

Performs a search in ThreatQuotient ThreatQ for indicators matching a specified value. Requires 'value' parameter.

Endpoint

URL: api/indicators/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Indicator Search with Value action
parameters.offset	number	Optional	Parameters for the Indicator Search with Value action
parameters.with	string	Optional	Parameters for the Indicator Search with Value action
parameters.value	string	Required	Parameters for the Indicator Search with Value action

Input Example

{"parameters":{"limit":100,"offset":100,"with":"adversaries,sources","value":"%test%"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.value	string	Response data
data.hash	string	Response data
data.class	string	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.last_detected_at	object	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data
data.type	object	Response data
data.type.id	number	Response data
data.type.name	string	Response data
data.status	object	Response data
data.status.id	number	Response data
data.status.name	string	Response data
data.status.description	string	Response data
limit	number	Output field: limit
offset	number	Output field: offset

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 30 Aug 2023 10:44:30 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Server":"Apache","X-Frame-Options":"SAMEORIGIN","Vary":"Authorization","Cache-Control":"no-cache","Content-Security-Policy":"frame-ancestors 'self';","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Set-Cookie":"threatq_api=eyJpdiI6In...

Indicators Query

Retrieve a filtered list of indicators from ThreatQuotient ThreatQ based on specified filter parameters.

Endpoint

URL: /api/indicators/query

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	string	Optional	The maximum number of results to return.
parameters.offset	string	Optional	The number of results to skip before starting to return results.
parameters.rows	string	Optional	The number of rows to return.
parameters.sort	string	Optional	The field to sort the results by.
fields	array	Optional	Parameter for Indicators Query
filters	object	Optional	The filters to apply to the results.
filters.+or	array	Optional	Parameter for Indicators Query
filters.+or.value	string	Optional	The value to filter by.
criteria	object	Optional	The criteria to apply to the results.
with	string	Optional	The fields to include in the results.

Input Example

{"parameters":{"limit":"25","offset":"0","rows":"0","sort":"-created_at"},"json_body":{"fields":["*","score","sources.name","sources.tlp_id"],"filters":{"+or":[{"value":"baddomain.com"},{"value":"68.68.21.21"},{"value":"helloworld.com"},{"value":"161fb353ab7e67341fd6a767aa596676"}]},"criteria":{},"with":"adversaries,attachments,attributes,attributes.attribute,comments,events,indicators,score,signatures,sources,status,tags,type,events,malware,campaign,incident,ttp,attack_pattern,report,tool,vulnerability"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
data	array	Response data
data.id	number	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.class	string	Response data
data.hash	string	Response data
data.value	string	Response data
data.last_detected_at	string	Response data
data.expires_at	object	Response data
data.expired_at	object	Response data
data.expires_calculated_at	object	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.touched_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":7481,"data":[{},{},{}]}}

Update Import Indicator

Updates an existing indicator within a specified import batch in ThreatQuotient ThreatQ, requiring import_id and import_indicator_id.

Endpoint

URL: api/imports/{{import_id}}/indicators/{{import_indicator_id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.import_id	number	Required	Parameters for the Update Import Indicator action
path_parameters.import_indicator_id	number	Required	Parameters for the Update Import Indicator action
value	string	Optional	Value for the parameter
type_id	string	Optional	Unique identifier
status_id	string	Optional	Unique identifier
source	object	Optional	Parameter for Update Import Indicator
source.name	string	Optional	Name of the resource
source.tlp	object	Optional	Parameter for Update Import Indicator
source.tlp.name	string	Optional	Name of the resource
whitelisted	string	Optional	Parameter for Update Import Indicator

Input Example

{"json_body":{"value":"99.99.99.96","type_id":"10","status_id":"2","source":{"name":"Adversary source","tlp":{"name":"GREEN"}},"whitelisted":"Y"},"path_parameters":{"import_id":1,"import_indicator_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.import_id	number	Response data
data.value	string	Response data
data.hash	string	Response data
data.type_id	number	Response data
data.status_id	number	Response data
data.source	string	Response data
data.import_event_id	object	Response data
data.whitelisted	string	Response data
data.duplicate	string	Response data
data.duplicate_indicator_id	object	Response data
data.created_indicator_id	object	Response data
data.parent_import_indicator_hash	object	Response data
data.type	object	Response data
data.type.id	number	Response data
data.type.name	string	Response data
data.type.class	string	Response data
data.type.score	object	Response data
data.type.wildcard_matching	string	Response data
data.type.created_at	string	Response data
data.type.updated_at	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"id":1133,"import_id":1,"value":"99.99.99.96","hash":"3f560465e1b9a5e1fee97b2fbf45de16","type_id":10,"status_id":2,"source":"New Source","import_event_id":null,"whitelisted":"Y","duplicate":"N","duplicate_indicator_id":null,"created_indicator_id":null,"parent_import_indicator_hash":null,"type":{}}}}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache
Connection	HTTP response header: Connection	keep-alive
Content-Security-Policy	HTTP response header: Content-Security-Policy	frame-ancestors 'self';
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 31 Aug 2023 07:33:24 GMT
Server	Information about the software used by the origin server	Apache
Set-Cookie	HTTP response header: Set-Cookie	threatq_api=eyJpdiI6IlR3RklqR2ZVXC9INXh4K25QUURqbTlRPT0iLCJ2YWx1ZSI6IjhuSlR5MWE1cnNUN1dodDcybXFIVnlyaVN2b0xKOHFTNk9HcmMrQlR0dWFjSHNxOTlFRWJSeHh1WXFOQjJUa295V2c0N1RyNVBQWkpmVkhLTWtOdkV3PT0iLCJtYWMiOiJiYmEwMzcyOGY0NzhmNTJiMDQwNTE3NjczMDVkMzQ2OWZjMDU1Mjc4NzQ1MWYzYjNiYTY2ZjA5ZjAzMGRlZTg5In0%3D; expires=Thu, 31-Aug-2023 08:33:24 GMT; Max-Age=3600; path=/api/; secure; HttpOnly; SameSite=strict
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Authorization
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block