Working with Files

Files in ThreatQ provide a way to store and manage supporting intelligence artifacts, such as threat reports, malware analyses, research documents, and other reference materials. The ThreatQ SDK enables you to upload files, associate them with sources, and, when applicable, extract and import indicators directly from file contents. This section demonstrates how to upload files and leverage ThreatQ's parsing capabilities to automatically create indicators from supported file types.

Upload a New File

Before uploading a file, import the required SDK classes:

Copy Code

1. Create a new File object and populate the required properties:

   Property	Description
   name	Name of the file object in ThreatQ
   ftype	File type classification
   path	Local path to the file being uploaded

   You may also optionally specify a title.

   file = File(tq)
   file.name = 'my-intel-report'
   file.ftype = 'Intelligence Report'
   file.path = '~/report.pdf'
   file.title = 'My Threat Report'

   Copy Code

2. Upload the file to ThreatQ:
   file.upload(sources=Source('Test'))

   Copy Code

   Unlike many other ThreatQ SDK objects, the upload() method automatically updates the File object with the newly assigned file ID.

3. To view the assigned file ID:

   print(file.fid)

   Copy Code

   Example output:

   1
   

Parse and Import Indicators from a File

Many intelligence documents contain indicators of compromise (IOCs) such as IP addresses, domains, URLs, hashes, and email addresses. The ThreatQ SDK can automatically parse supported file types and import discovered indicators into the Threat Library.

Before indicators can be parsed, the file must already exist in ThreatQ and have a valid file ID.

The following fields are required:

In the following example, a previously uploaded file has an ID of 2. The SDK parses the file using the default Generic Text parser and imports all discovered indicators with a status of Active and a source of Test Source.

Copy Code

Notes

• The file must already be uploaded to ThreatQ before parsing can occur.
• The default parser is Generic Text.
• Imported indicators are automatically added to the Threat Library.
• Source and status values should align with your organization's intelligence workflow and governance standards.