Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The First EPSS action submits a data collection containing CVE IOCs to First EPSS and returns enriched IOCs and relevant attributes.

The integration can perform the following action:

• First EPSS - Submits indicators to First EPSS API to be enriched with related threat intelligence.

The action is compatible with CVE indicator types.

The action returns enriched indicator and indicator attributes.  

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• An active ThreatQ TDR Orchestrator (TQO) license.
• A data collection containing CVE indicator objects.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   Objects Per Run	The max number of objects per run to send to this action. The max value for this parameter is 50,000.
   Date	Select the date for which to pull data.  The format is as follows: YYYY-MM-DD.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The integration provides the following action:

{
    "status": "OK",
    "status-code": 200,
    "version": "1.0",
    "access": "public",
    "total": 1,
    "offset": 0,
    "limit": 100,
    "data": [
        {
            "cve": "CVE-2023-25193",
            "epss": "0.008900000",
            "percentile": "0.297670000",
            "date": "2023-02-06"
        }
    ]
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Known Issues / Limitations

• The attributes value will be based on the configuration parameter: Date.  Example: if you select a date of 2023-01-01, the attributes values will be from that day.

Change Log

• Version 1.0.0
  • Initial release