Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Digital Shadows minimizes digital risk by identifying unwanted exposure and protecting against external threats. It is an intelligence feed that provides detailed reports on, Incidents, Indicators and more.

As a Digital Shadows user, the integrations ingests Incidents and IOCs (that are found within an incident report) into the ThreatQ platform.  

Digital Shadows Incidents CDF replaced the Digital Shadows feed that was previously seeded in the ThreatQ platform (prior to ThreatQ v4.30).

Prerequisites

The DigitalShadows feed was renamed Digital Shadows Incidents and deployed as a configuration driven feed (CDF) with ThreatQ version 4.30.

After upgrading to ThreatQ version 4.30, the DigitalShadows feed will be renamed to Digital Shadows Incidents. Users that were using the DigitalShadows feed prior to upgrading will need to reenable the feed.

If you are installing the Digital Shadows Incidents feed on a platform version prior to 4.30 (using the yaml file from marketplace.threatq.com), the feed will install as a new feed and the existing DigitalShadows feed seeded with the platform will remain.

Digital Shadows Incidents objects will be ingested as ThreatQ incident objects by default. This setting can be updated to ingest objects as ThreatQ events, as the previous DigitalShadows feed operated, by updating the feed’s configuration under the integration's details page.

The following attribute names will be migrated upon installing/updating the feed:

• Digital Shadows Severity -> Severity
• Digital Shadows Type -> Type
• Digital Shadows Score -> Score
• Digital Shadows URL -> URL
• Digital Shadows Received Time -> Verified At

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API ID	API ID provided by Digital Shadows. Necessary for authentication.
   API Key	API key provided by Digital Shadows. Necessary for authentication.
   Ingest as Incident Objects	If checked, ingests fetched incidents as ThreatQ Incident objects. Otherwise, fetched incidents are ingested as ThreatQ Event Objects.   This parameter is checked by default.
   Feed URL	For UI display purposes only.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
  "content": [
    {
      "id": 12345,
      "scope": "ORGANIZATION",
      "type": "DATA_LEAKAGE",
      "subType": "INTERNALLY_MARKED_DOCUMENT",
      "severity": "MEDIUM",
      "title": "Protectively marked document available on company site",
      "published": "2019-11-17T15:20:50.984Z",
      "summary": "Protectively marked document available on company site",
      "modified": "2019-11-17T15:20:50.984Z",
      "occurred": "2019-11-17T12:20:50.984Z",
      "verified": "2019-11-17T13:20:50.984Z",
      "tags": [
        {
          "id": 358,
          "name": "Protectively Marked Document",
          "type": "DATA_LEAKAGE"
        },
        {
          "id": 172,
          "name": "English",
          "type": "LANGUAGE"
        }
      ],
      "version": 1,
      "entitySummary": {
        "source": "www.slideshare.net/johnwynne/internal_review",
        "summaryText": "Strictly private and confidential.",
        "domain": "www.slideshare.net",
        "sourceDate": "2019-11-16T15:20:50.984Z",
        "screenshotId": "47d07513-db48-4589-b5d9-cad00ec1fe89",
        "screenshotThumbnailId": "1d5f6a48-3cec-4f3f-aa29-cef4d86ddaa4",
        "type": "WEB_PAGE",
        "fullText": "Strictly private and confidential. Not for distribution. This material is provided to Addressee Only. ",
        "contentRemoved": false
      },
      "description": "Protectively marked document available on company site",
      "linkedContentIncidents": [
        {
          "id": 8363,
          "title": "Protectively marked document available on public site",
          "occurred": "2019-11-16T09:20:50.984Z",
          "severity": "HIGH",
          "scope": "ORGANIZATION"
        }
      ],
      "internal": true,
      "alerted": "2019-11-17T13:35:50.984Z",
      "mitigation": "If document is is not for publication, consider removing from company site.",
      "impactDescription": "Protectively marked document exposed on public website. Per the Severity Matrix, we assess the severity of this incident as High since the protectively marked document is less than one year old, is available for public consumption and review, and is explicitly marked \"Strictly private and confidential\". ",
      "takedownRequestCount": 1,
      "review": {
        "note": "Incident actioned internally by Kim Bryon",
        "status": "CLOSED",
        "user": {
          "id": "3a49f01b-6863-468b-a963-b34c5fa87805",
          "fullName": "Sam Neil",
          "permissions": []
        },
        "created": "2019-11-17T15:20:50.747Z"
      }
    }
  ],
  "currentPage": {
    "offset": 3,
    "size": 20
  },
  "total": 200
}

Known Issues / Limitations

• The integration only supports a Start Date for manual runs and will use the current time as the End Date.

Change Log

• Version 1.1.0
  • Fixed an issue where a pagination error would sometimes keep a feed run from completing.
• Version 1.0.1
  • Fixed an issue where some attributes would display incorrectly.
• Version 1.0.0
  • Initial release