Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The CISA Reports CDF consumes data provided by the CISA to notify organizations about threats that exist on the Internet.

The integration provides the following endpoint:

• CISA Reports - ingests reports from the xml source as well as related system objects.

The integration ingests the following system object types:

• Files
• Incidents
• Indicators
• Reports
• TTPs

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the integration file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

6. The feed will be added to the integrations page. You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the OSINT option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Verify SSL	When enabled, the integration will validate the host-provided SSL certificate.  This option is enabled by default.
   Parse Tags	Enable this option to automatically add tags to the report object.  This option is enabled by default.
   Parse for Selected Indicators	Select the indicator types to be parsed for reports.  Options include CVEs (default) MD5 Hashes (default) SHA-1 Hashes (default) SHA-256 Hashes (default) SHA-512 Hashes (default) IP Addresses (default) Email Addresses (default) This parameter does not apply to parsed STIX files.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xml:base="https://www.cisa.gov/">
	<channel>
		<title>CISA Analysis Reports</title>
		<link>https://www.cisa.gov/</link>
		<description/>
		<language>en</language>
		<item>
			<title><a href="/news-events/analysis-reports/ar22-272a" hreflang="en">MAR-10365227-2.v1 </a></title>
            <link>https://www.cisa.gov/news-events/analysis-reports/ar22-272a</link> 
			<description>Original release date: October 31, 2019 ... </description>
			<pubDate>Thu, 31 Oct 2019 14:57:45 +0000</pubDate>
			<dc:creator>CISA</dc:creator>
			<guid isPermaLink="false">/node/9076</guid>
		</item>
		...
	</channel>
</rss>

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 2.0.6
  • Enhanced the integration by adding support for email address extraction and ingestion of tags from report bodies.
  • Added a new option, Email Addresses, to the Parse for Selected Indicators configuration parameter.
• Version 2.0.5
  • Improved the resilience of the STIX link and attachment handling pipeline, preventing application crashes when required data is missing.
  • Resolved a NoneType iteration error during STIX parsing by initializing safe default values.
• Version 2.0.4
  • Resolved a parsing issue with the RSS feed regarding the pubDate. 
• Version 2.0.3
  • Resolved a title parsing issue that was caused by a provider change to the <title> XML format.    
• Version 2.0.2
  • Updated the integration's endpoint based on website migration updates by the provider.  
  • Rebranded to integration from US-CERT Reports to CISA Reports.
• Version 2.0.1
  • Added the ability to parse Tags. 
  • Fixed an issue where the wrong TTP objects were parsed.   
• Version 2.0.0
  • Initial Release.  This endpoint used to be included in the US-CERT integration.  That integration has been deprecated and its endpoints split into four separate CDFs.