Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Deception Logic HoneyDB CDF ingests data from HoneyDB Bad Hosts; a feed that consumes information published by HoneyDB about bad hosts. A bad host is a host on the Internet that has connected or attempted to connect to one of the honeypots that feed data to HoneyDB.

The integration provides the following feed:

• HoneyDB Bad Hosts - ingests IP Address indicators from the HoneyDB.

The integration ingests indicators (IP Addresses) into the ThreatQ platform.   

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API ID	Your HoneyDB API ID.
   API Key	Your HoneyDB API Key.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

[
   {
      "remote_host":"121.183.78.86",
      "count":"203",
      "last_seen":"2015-09-07"
   },
   {
      "remote_host":"117.12.127.121",
      "count":"203",
      "last_seen":"2015-09-07"
   },
   {
      "remote_host":"60.3.51.115",
      "count":"203",
      "last_seen":"2015-09-07"
   }
]

Change Log

• Version 1.0.0
  • Initial release