Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The abuse.ch ThreatFox Action submits a collection of indicators to the abuse.ch ThreatFox API in the form of individual HTTP requests.  The returning response will provide additional contextual information for every indicator submitted.

The action can perform the following function:

• abuse.ch ThreatFox - enriches supported objects with attributes and related objects describing the IOC.

The action is compatible with the following indicator types:

• MD5
• SHA-1
• SHA-256
• FQDN
• IP
• URL
• Email Address

The action returns the following enriched system objects:

• Indicators
• Malware

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• An active ThreatQ TDR Orchestrator (TQO) license.
• A data collection containing at least one of the following indicator types:
  • MD5
  • SHA-1
  • SHA-256
  • FQDN
  • IP
  • URL
  • Email Address
• Abuse.ch ThreatFox API key.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   Auth Key	Enter your abuse.ch authentication key.
   Enable SSL Certificate Verification	Enable this for the feed to validate the host-provided SSL certificate.
   Disable Proxies	Enable this option if the feed should not honor proxies set in the ThreatQ UI.
   Supporting Context	Select the context you want to ingest into ThreatQ.  Options include: Threat Type (default) Threat Type Description Related Malware (default) Related Malware (default) Samples (Hashes) Malware Aliases (default) Malware Identifier (i.e. "win.asyncrat") Malware Malpedia Reference (External Reference)  abuse.ch Reference (External Reference) Confidence Level (default) First Seen Last Seen Reporter Tags (default)
   Objects Per Run	The maximum number of objects to send to this action, per run.  The maximum value for this parameter is 50,000.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Action Functions

The action provides the following function:

{
  "query": "search_ioc",
  "search_term": "<ioc_value>"
}

{
    "query_status": "ok",
    "data": [
        {
            "id": "1035527",
            "ioc": "https://xoopscube.xyz/vema/index.php?QBOT.zip",
            "threat_type": "payload_delivery",
            "threat_type_desc": "Indicator that identifies a malware distribution server (payload delivery)",
            "ioc_type": "url",
            "ioc_type_desc": "URL that delivers a malware payload",
            "malware": "win.qakbot",
            "malware_printable": "QakBot",
            "malware_alias": "Oakboat,Pinkslipbot,Qbot,Quakbot",
            "malware_malpedia": "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot",
            "confidence_level": 100,
           "first_seen": "2022-12-07 18:58:08 UTC",
           "last_seen": null,
           "reference": null,
            "reporter": "Cryptolaemus1",
            "tags": [
                "BB09",
                "QakBot",
                "qbot",
                "Quakbot",
                "TR",
                "U12",
                "vhd",
                "zip"
            ],
            "malware_samples": []
        }
    ]
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Use Case Example

1. A Threat Analyst identifies a collection of supported objects they would like to enrich.
2. The Threat Analyst adds the abuse.ch ThreatFox Action to a workflow.
3. The Threat Analyst configures the action with the desired parameters and enables the workflow.
4. The workflow executes all actions in the graph, including the abuse.ch ThreatFox action.
5. The action returns the documented objects from the provider, ingesting them into the ThreatQ platform.

Change Log

• Version 1.0.2
  • Added support for authenticating with the API.
  • Added the option to to enable SSL certificate verification and/or disable proxies.
  • Resolved timstamp parsing issues.
• Version 1.0.1
  • The action is now capable of parsing the entire data from the response.
  • Updated action standards.
  • Updated minimum ThreatQ version to 5.14.1.  
• Version 1.0.0
  • Initial release