Current ThreatQ Version Filter
 

Area 1 CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Area 1 provides anti-phishing services and intelligence data based in their research for customers.  The Area 1 CDF ingests this intelligence data into your ThreatQ instance.  

The integration provides the following feed:

  • Area 1 - consumes indicators from the Area 1 security vendor from their /indicators endpoint.

The integration ingests adversaries and indicators (FQDN, IP Address, MD5, SHA-1, SHA-256).  The integration also provides the following supporting context:

  • Category
  • Classification Disposition
  • Confidence
  • Delivery Vector
  • Last Seen
  • Malware Family
  • Threat Name
  • Threat Type    

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the Labs option from the Category dropdown (optional).

    If you are installing the integration for the first time, it will be located under the Disabled tab.

  3. Click on the integration entry to open its details page.
  4. Enter the following parameters under the Configuration tab:
    Parameter Description
    Feed Name The name of the feed that will be displayed in the ThreatQ UI.
    Username Your Area 1 account username for the HTTPS basic authentication.
    Password Your Area 1 account password for the HTTPS basic authentication.
  5. Review any additional settings, make any changes if needed, and click on Save.
  6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

Area 1

The Area1 feed consumes indicators from the Area1 security vendor from their /indicators endpoint. The feed consumption happens over https using basic authentication. 

Sample Response:

{
    "data": [
        {
            "threat_name": "Area 1 Identified Malicious",
            "first_seen": 1539088006512,
            "last_seen": 1539088006512,
            "item_type": "url",
            "item_name": "elitebeauty.co.ke\/wp-includes\/widgetss\/",
            "threat_categories": [
                {
                    "classification_disposition": [
                        "Unclassified"
                    ],
                    "delivery_vector": [
                        "Phishing"
                    ],
                    "threat_type": [
                        "Actor Infrastructure"
                    ],
                    "category": [
                        "Universal"
                    ]
                }
            ]
        },
        {
            "tag_histories": [
                {
                    "intervals": [
                        {
                            "start": 1435384584000,
                            "end": "current"
                        }
                    ],
                    "category": "Actor",
                    "value": "PUB5"
                },
                {
                    "intervals": [
                        {
                            "start": 1435384584000,
                            "end": "current"
                        }
                    ],
                    "category": "Indicator Category",
                    "value": "Targeted"
                },
                {
                    "intervals": [
                        {
                            "start": 1435384584000,
                            "end": "current"
                        }
                    ],
                    "category": "Malware",
                    "value": "ZxShell"
                }
            ],
            "threat_name": "Area 1 Identified Malicious",
            "first_seen": 1441142508566,
            "last_seen": 1441142508566,
            "item_type": "filehash",
            "item_name": "032f43180589c60443063f86ac42486d614c8efd1ee4660200d34466ff3fd806",
            "threat_categories": [
                {
                    "actor": [
                        "PUB5"
                    ],
                    "classification_disposition": [
                        "Unclassified"
                    ],
                    "malware": [
                        "ZxShell"
                    ],
                    "threat_type": [
                        "Actor Tool"
                    ],
                    "category": [
                        "Targeted"
                    ]
                }
            ]
        },

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Normalization Published Date Examples Notes
item_value Indicator IP Address   first_seen   item_type == 'address'
item_value Indicator FQDN   first_seen   item_type == 'domain'
item_value Indicator URL Remove url encoding first_seen   item_type == 'url'
item_value Indicator SHA-256   first_seen   item_type == 'filehash' && len(item_value) == 64
item_value Indicator SHA-1   first_seen   item_type == 'filehash' && len(item_value) == 40
item_value Indicator MD5   first_seen   item_type == 'filehash' && len(item_value) == 32
last_seen Attribute Last Seen   first_seen 1539063959074  
threat_name Attribute Threat Name   first_seen Google Credential Harvester  
threat_categories[].actor[] Adversary Name   first_seen CN41  
threat_categories[].category[] Attribute Category   first_seen [Targeted, Universal]  
threat_categories[].classification_disposition[] Attribute Classification Disposition   first_seen Unclassifed  
threat_categories[].delivery_vector[] Attribute Delivery Vector   first_seen Phishing  
threat_categories[].malware[] Attribute Malware Family   first_seen RIG_Exploit_kit  
threat_categories[].threat_type[] Attribute Threat Type   first_seen Actor Infrastructure  
overall_confidence Attribute Confidence   first_seen 60  
tag_histories[].category + " - " +tag_histories[].value Indicator Tag Split CamelCase, - to Spaces first_seen Escalation Reason - Promotion Multi Source Collision  

Known Issues / Limitations

  • The Tag field on indicators is not created for this feed.

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
Area 1 CDF Guide v1.0.0 4.11.0 or Greater