Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Flashpoint Ignite Alerts CDF for ThreatQ enables the automatic ingestion of an alert within Flashpoint.

The integration ingests threat intelligence data from the following endpoint:

• Flashpoint Ignite Alerts -  ingests Ignite Alert data into the ThreatQ platform.  

The integration ingests following object types:

• Adversaries
• Events
  • Event Attributes
• Indicators
• Vulnerabilities

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration yaml file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

6. The feed will be added to the integrations page.  You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameter under the Configuration tab:

   Parameter	Description
   API Key	Your Flashpoint Ignite Alerts API Key.
   API Options	Optional - Enter a line-separated list of query IDs to filter alerts.
   Ingest Highlights	Enable this parameter to ingest highlights.
   Link Adversaries to Alerts	Enable this parameter to link ingested adversaries to alerts. This parameter is disabled by default.
   Save CVE Data as	Select how to ingest CVEs as into the ThreatQ platform. Options include: Indicators Vulnerabilities
   Enable SSL Verification	Enable this parameter to validate the host-provided SSL certificate. This parameter is enabled by default.
   Disable Proxies	Enable this option if the feed should not honor proxies set in the ThreatQ UI.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "items": [
        {
      "id": "8a45bd35-1fac-4b35-aa27-630ab3821507",
      "resource": {
        "id": "LIjNc-xrVUynzUwsoqPfVw",
        "basetypes": [
          "chat",
          "conversation",
          "message",
          "telegram"
        ],
        "title": "𝗕𝗜𝗚𝗙𝗔𝗧𝗖𝗛𝗔𝗧™️💰",
        "sort_date": "2024-06-03T20:15:07Z",
        "site": {
          "title": "Telegram"
        },
        "container": {
          "name": "𝗕𝗜𝗚𝗙𝗔𝗧𝗖𝗛𝗔𝗧™️💰",
          "native_id": "1213408970",
          "title": "𝗕𝗜𝗚𝗙𝗔𝗧𝗖𝗛𝗔𝗧™️💰"
        },
        "site_actor": {
          "names": {
            "handle": "RISK"
          },
          "native_id": "5375938422"
        },
        "created_at": {
          "date-time": "2024-06-03T20:15:07+00:00",
          "raw": "1717445707",
          "timestamp": 1717445707
        }
      },
      "reason": {
        "id": "218f7b12-8c85-474e-8013-98d014e99c8c",
        "name": "Insider Threat Alerts",
        "text": "(\"I am an employee\" OR \"i'm an employee\" OR \"i can get access\" OR \"i have access to\" OR \"i work at\" OR \"i work for\" OR inny OR \"i'm employed at\" OR \"my occupation is\") NOT arsenal",
        "origin": "two-face",
        "details": {
          "sources": [
            "communities"
          ],
          "params": {
            "sort": "relevancy",
            "exclude": {},
            "include": {
              "date": {
                "end": "now",
                "label": "Last 7 Days",
                "start": "now-7d"
              }
            }
          }
        },
        "entity": {
          "id": "001o000000igOLYAA2",
          "name": "ThreatQ",
          "type": "organization"
        }
      },
      "status": null,
      "generated_at": "2024-06-03T20:16:12.875144Z",
      "created_at": "2024-06-03T20:16:14.716472Z",
      "tags": {},
      "highlights": {
        "body.text/plain": [
          "Nah I need 6 figs stims tho can fly you out where inny at"
        ]
      },
      "highlight_text": "Nah I need 6 figs stims tho can fly you out where inny at",
      "data_type": "chat",
      "parent_data_type": null,
      "source": "communities",
      "is_read": false
    }
    ],
  "pagination": {
    "next": "https://api.flashpoint.io/alert-management/v1/notifications?created_after=now-7d&created_before=nowATsize=25&cursor=1717444021.230215",
    "first": "https://api.flashpoint.io/alert-management/v1/notifications?created_after=now-7d&created_before=nowATsize=25&cursor=1717445812.558666"
  }
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.2.7
  • Resolved an issue where missing container and title information would cause feed runs to fail with an error applying filter error message. 
• Version 1.2.6
  • The integration now ingests adversary object types.   
  • Added a new configuration parameter:
    • Link Adversaries to Alerts - link ingested adversaries to alerts.  
• Version 1.2.5
  • Resolved an issue with incorrect Flashpoint Ignite links for Media type events.  
• Version 1.2.4
  • Flashpoint Ignite links to alert descriptions are now ingested as descriptions in ThreatQ.   
• Version 1.2.3
  • Site Actors are no longer ingested as related Adversaries.
  • Context information will no longer be included in the description and will now be saved as attributes.
  • Added a new configuration parameter:
    • Save CVE Data As - select if CVEs should be ingested as Indicators or Vulnerabilities.  
• Version 1.2.2
  • Added a new configuration parameter: Ingest Highlights.  Users can use this setting to control if the feed will ingest Alert Highlights attribute.
  • Removed HTML tags from the Alert Highlights attribute.
• Version 1.2.1
  • Updated the style for Event descriptions.
  • Added Search Text and Alert Highlights attributes to Events.
  • Added Actors as related Adversaries.
  • Added two new configuration parameters: Disable Proxies and Enable SSL Verification.
• Version 1.2.0
  • Updated the feed to use Flashpoint Ignite Alerts endpoint.
    • Alerts now include rich text descriptions containing alert highlights and metadata.
    • Alert Titles have been improved.
    • The Flashpoint Link attribute has been replaced with a link within the description. 
  • Rebranded the integration to FlashPoint Ignite Alerts CDF.
  • Updated the minimum ThreatQ version to v5.12.1.  
• Version 1.1.1
  • Long alert bodies, which would trigger feed errors, are now truncated.
• Version 1.1.0
  • Optimized integration code to improve overall performance and upgraded support tier from Not Supported to ThreatQ Supported.  
• Version 1.0.0
  • Initial Release