Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

ThreatQ integration with IBM X-Force® Incident Response and Intelligence Services (IRIS) team integrates security threat intelligence, incident response and remediation to help minimize the loss.

The integration provides the following feeds:

The integration ingests indicator and indicator attributes.  

Prerequisites

Per the IBM X-Force Exchange documentation:  these feeds are only available for users with either an Advanced Threat Protection Feed subscription or an Enterprise subscription. For information regarding subscriptions, you can visit the IBM Marketplace.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Your IBM X-Force Exchange API Key.
   API Password	Your IBM X-Force Exchange API password.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
  "FeedCategory": "Anonymization Services",
  "FeedType": "IPv4",
  "Version": "0000043381",
  "CreationDate": "2020-02-20T08:05:30.597Z",
  "IndicatorCount": "3",
  "PartNo": "D01VKZX",
  "Copyright": "(C) Copyright IBM Corp. 2019, 2020. All Rights Reserved.",
  "data": [
        "109.75.183.124",
        "109.74.194.75",
        "107.148.6.184"
  ]
}

{
  "FeedCategory": "Top-Volume Domains",
  "FeedType": "URL",
  "Version": "0000000372",
  "CreationDate": "2020-12-16T00:23:01.497Z",
  "IndicatorCount": "10000",
  "PartNo": "D01VKZX",
  "Copyright": "(C) Copyright IBM Corp. 2019, 2020. All Rights Reserved.",
  "data": [
    {
      "url": "google.com",
      "categories": [
        "Search Engines / Web Catalogues / Portals"
      ]
    },
    {
      "url": "netflix.com",
      "categories": [
        "Cinema / Television"
      ]
    },
    {
      "url": "microsoft.com",
      "categories": [
        "Software / Hardware",
        "General Business"
      ]
    }
  ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

IBM X-Force Exchange - Anonymization Services - IPv4

IBM X-Force Exchange - Anonymization Services - IPv6

IBM X-Force Exchange - Anonymization Services - URL

IBM X-Force Exchange - Botnet CnC Servers - IPv4

IBM X-Force Exchange - Botnet CnC Servers - IPv6

IBM X-Force Exchange - Botnet CnC Servers - URL

IBM X-Force Exchange - Bots - IPv4

IBM X-Force Exchange - Bots - IPv6

IBM X-Force Exchange - Cryptocurrency mining - IPv4

IBM X-Force Exchange - Cryptocurrency mining - IPv6

IBM X-Force Exchange - Cryptocurrency mining - URL

IBM X-Force Exchange - Early Warning - URL

IBM X-Force Exchange - Malware - IPv4

IBM X-Force Exchange - Malware - IPv6

IBM X-Force Exchange - Malware - URL

IBM X-Force Exchange - Phishing - URL

IBM X-Force Exchange - Scanning IPs - IPv4

IBM X-Force Exchange - Scanning IPs - IPv6

• At the time these feed run metrics were gathered, this feed returned only a single IPv6 address: 2001:db8:1234::3. Reserved IPv6 addresses are not ingested by ThreatQ, and any addresses matching the CIDR Block 2001:db8::/32 are reserved per RFC 3949.

IBM X-Force Exchange - Top Activity - URL / 10K

Known Issues / Limitations

• Streaming errors that occur between the X-Force Exchange server and ThreatQ, after the HTTP status code 200 was received by ThreatQ, will cause the stream to end. This will cause the following feed run error as seen in the ThreatQ UI: Error fetching data from provider: 524, message='None'. This corresponds to a 524 Timeout Occurred error. The user can disable and re-enable the feed in order to kick off another scheduled run to try again. This error may occur several times in a row.
  • This error is also documented in the IBM X-Force Exchange documentation.
• Due to the amount of data provided by the feed IBM X-Force Exchange - Early Warning - URL, users may experience ThreatQ system performance issues, such as failed batches due to timeout errors. There is not much one can do to completely mitigate this, but some suggestions are:
  • Make sure IBM X-Force Exchange - Early Warning - URL is the only feed enabled when one wants to run it.
  • Do not leave IBM X-Force Exchange - Early Warning - URL enabled for consecutive daily runs. Periodically re-enable it to ingest the latest data. Each run will attempt to consume over 800k URL Indicators.

Change Log

• Version 1.1.0
  • Removed ingesting the following attributes from all IBM X-Force Exchange feeds:
    • Feed Type
    • Copyright
    • Version
    • Part Number
  • Removed the Feed Category attribute from all feeds (except for IBM X-Force Exchange - Top Activity - URL / 10k).
  • Improved efficiency of IBM X-Force Exchange - Top Activity - URL / 10K.
  • By default, all Indicators ingested via IBM X-Force Exchange - Top Activity - URL / 10K will have the Review Indicator Status since the URLs provided by this feed are not guaranteed to be malicious or non-malicious.
• Version 1.0.0
  • Initial release