Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Intel 471 Indicators - Malware Intelligence integration returns a list of indicators that match filter criteria from the following endpoint:

• Intel 471 Indicator - Malware Intelligence - retrieves indicator intelligence and YARA signatures from the Intel 471 cloud Indicators stream and ingests them into ThreatQ as Indicator and Signature objects with associated attributes.

The integration ingests the following system objects:

• Indicators
  • Indicator Attributes
• Signatures
  • Signature Attributes

Prerequisites

The following is required to run the integration:

• An Intel 471 Client ID.
• An Intel 471 Client Secret.

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the integration file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

6. If prompted, select the individual feeds to install and click Install. The feed will be added to the integrations page. 

You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Client ID	Enter your Intel 471 Client ID.
   Client Secret	Enter your Intel 471 Client Secret
   Fetch GIR Names	Enable this parameter to include each GIR name with its corresponding path. Disable it to use the raw GIR paths. This parameter is enabled by default
   Indicator Type	Select an indicator type to send as the type query parameter. Options include: ALL Domain Email File IPv4 (default) URL YARA Selecting ALL omits the parameter and retrieves all available indicator types. This may produce a large result set and require thousands of paginated API requests. Select specific values whenever possible to reduce API usage.
   Threat Type	Select a threat type to send as the threat_type query parameter. Options include: ALL Malware (default) Bulletproof Hosting Selecting ALL omits the parameter and may return a large result set requiring thousands of paginated API requests. Select specific values whenever possible to reduce API usage.
   Confidence	Select a confidence level to send as the confidence query parameter. Options include: ALL (default) High Medium Low Selecting ALL omits the parameter.
   Text Filter	Optional - Enter text to filter the indicators returned by the feed. Example: btmob.
   Malware Family Name	Optional - Enter a malware family name to filter the returned indicators. Example: btmob.
   GIRs	Optional - Enter one or more comma-separated GIR paths, or enter my_girs or company_pirs to retrieve indicators from those GIR collections. Example: 1.1.5,2.1.3.
   Page Size	Enter the number of records to request per page. Valid values range from 1 to 1000. The default value is 1000.
   Enable SSL Certificate Verification	Enable this parameter if the feed should validate the host-provided SSL certificate.
   Disable Proxies	Enable this parameter if the feed should not honor proxies set in the ThreatQ UI.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "count": 1,
    "cursor_next": "NTg2ZDYwOWUtNzhmMS00MDY5LTg3M2QtYTI5MWRjNzBhNTYyOjE3ODY4NDI0NjA4MjA6ZThhZWE2NTI0ZjBhOWI2MGQ4OTUwNmNkYjc2M2ExYjg3ODg0MWJiYw",
    "indicators": [
        {
            "activity": {
                "first_seen_ts": "2026-08-11T20:28:31Z",
                "last_seen_ts": "2026-08-15T20:28:49Z"
            },
            "classification": {
                "girs": [
                    {
                        "path": "1.1.2",
                        "name": "Mobile malware"
                    },
                    {
                        "path": "1.1.4",
                        "name": "Banking trojan malware"
                    },
                    {
                        "path": "1.4.4",
                        "name": "Android"
                    }
                ]
            },
            "confidence": 50,
            "data": {
                "ipv4": {
                    "ip_address": "130.94.40.138",
                    "geo_ip": {
                        "country": "Singapore",
                        "country_code": "SG",
                        "city": "Singapore",
                        "isp": {
                            "isp": "LIGHT NODE LIMITED",
                            "organization": "LIGHT NODE LIMITED",
                            "autonomous_system": "AS154177 LIGHT NODE LIMITED",
                            "network": "130.94.0.0/18"
                        }
                    }
                }
            },
            "description": "btmob controller IPv4",
            "expiration_ts": "2026-09-11T20:28:57Z",
            "id": "malware-indicator--3f5e3ccb-76bd-53b7-b2f0-04041045c888",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "command_and_control"
                }
            ],
            "pattern": "[ipv4-addr:value = '130.94.40.138']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "threat": {
                "type": "malware",
                "data": {
                    "malware": {
                        "id": "malware--58bc1e16-a79e-5436-abe8-0576d0ad354b",
                        "family": "btmob",
                        "version": "BT-v5.0.1"
                    },
                    "malware_family": {
                        "id": "malware-family--7398e343-b9ae-56c8-ba12-30ac9541e9cd",
                        "name": "btmob"
                    }
                }
            },
            "type": "ipv4"
        }
    ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 2.0.0
  • Updated the integration to use the Intel 471 cloud API and corresponding cloud schema mappings.
  • Added support for client credential authentication, configurable filters, and page-size settings.
  • Added Unix millisecond conversion for the from parameter and cursor-based pagination within each feed run.
  • Removed the following configuration parameters:
    • Email Address
    • API Key

  • Added the following new configuration parameters:

    • Client ID: Specifies the Intel 471 Client ID used as the HTTP Basic authentication username.
    • Client Secret: Specifies the Intel 471 Client Secret used as the HTTP Basic authentication password.
    • Fetch GIR Names: Controls whether GIR names are included with their corresponding paths. Enabled by default.
    • Threat Type: Filters indicators by threat type. Available options include ALL, Malware (default), and Bulletproof Hosting.
    • Confidence: Filters indicators by confidence level. Available options include ALL (default), High, Medium, and Low.
    • Text Filter: Filters returned indicators using the specified text.
    • Malware Family Name: Filters returned indicators by malware family name.
    • GIRs: Filters returned indicators using specified GIR paths or the my_girs or company_pirs collections.
    • Page Size: Specifies the number of records requested per page, from 1 to 1000. The default value is 1000.
    • Enable SSL Verification: Controls whether the integration verifies the endpoint’s SSL certificate. Enabled by default.
    • Disable Proxies: Controls whether the integration bypasses proxies configured in ThreatQ. Disabled by default.
  • Added additional options to the Indicator Type configuration parameter.
  • Updated the minimum ThreatQ version to 5.24.0.
• Version 1.2.0
  • Updated the endpoint to use the streaming API. 
  • Removed the Count user configuration option.   
• Version 1.1.1
  • Fixed feed name typo.
• Version 1.1.0
  • Added ability to ingest all indicator types at once.
• Version 1.0.0
  • Initial release.