Current ThreatQ Version Filter

Authentication

You must first import the base Threatq object before performing any SDK operations. The Threatq object serves as the primary interface for authenticating and interacting with the ThreatQ API.

  1. Import the base Threatq object: 
    from threatqsdk import Threatq

  2. Authenticate with the ThreatQ API using one of the following methods:
    • OAuth Client Credentials (recommended)
      tq_host = ' < Your ThreatQ Instance IP > '
      clientID = ' < OAuth Client ID > '
      clientsecretID = ' <OAuth Client Secret> '
      tq = Threatq(host,(clientID,clientsecretID),True)

      Replace the tq_host, clientID, and clientsecretID entries with your information. Follow the steps provided in the Creating OAuth Client Credentials section below.

      You must use the flag True in the final line, as shown above. Failing to use this flag will result in the application defaulting to the username/password method.  

    • Username and Password Authentication
      tq_host = 'https://localhost:8443'
      username = '< USERNAME >'
      password = '< PASSWORD >'
      clientid = ' < CLIENT ID > '
      tq = Threatq(tq_host, {'clientid': clientid, 'auth': { 'email': username, 'password': password}})

      Replace the USERNAME, PASSWORD, and CLIENT ID with your information. This information can be obtained by viewing your user profile in ThreatQ.

Creating OAuth Client Credentials

OAuth Client Credentials provide a secure method for custom integrations and automation workflows. The process below provides steps on generating OAuth Client Credentials. See the OAuth Credentials topic for additional information regarding this command.

  1. SSH to your ThreatQ installation.
  2. Create a new client id and client secret password using the following command:
    kubectl exec --namespace threatq --stdin --tty deployment/api-schedule-run -- ./artisan threatq:oauth2-client --name="Custom Integration"

    Replace Custom Integration in the command above with whatever name you want to use.

    You should see output for the new custom integration user:

    session_timeout_minutes: 1440
    name: Custom Integration
    type: private
    client_id: ntdjzwe3mduyyjqxyjdiyza5mzyxmtkx
    client_secret: YThlOTBlZjM0YTYxNWM1YjVkODdmMTdjNGY5MzZkYTg4M2RmYmRiZGJmNjk1OTRm
    updated_at: 2020-01-14 14:03:27
    created_at: 2020-01-14 14:03:27

  1. SSH to your ThreatQ installation and navigate to the api directory using the following command:
    cd /var/www/api

  2. Create a new client id and client secret password using the following command:
    php artisan threatq:oauth2-client --name="Custom Integration"

    You should see output for the new custom integration user:

    session_timeout_minutes: 1440
    name: Custom Integration
    type: private
    client_id: ntdjzwe3mduyyjqxyjdiyza5mzyxmtkx
    client_secret: YThlOTBlZjM0YTYxNWM1YjVkODdmMTdjNGY5MzZkYTg4M2RmYmRiZGJmNjk1OTRm
    updated_at: 2020-01-14 14:03:27
    created_at: 2020-01-14 14:03:27