Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Intel 471 Indicators - Malware Intelligence integration returns a list of indicators that match filter criteria from the following endpoint:

• Intel 471 Indicator - Malware Intelligence - https://api.intel471.com/v1/indicators/stream

The integration ingests indicator and indicator attributes.  

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Email Address	Your Intel 471 account email address.
   API Key	Your Intel 471 account API key.
   Indicator Type	Search indicators by type (file, ipv4, url). If no option is selected, all indicator types are queried.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "indicatorTotalCount": 224181,
    "indicators": [
        {
            "data": {
                "indicator_id": "c8c1385ee0411410463bb39a8a944c2ec7025d09",
                "threat": {
                    "type": "malware",
                    "uid": "b38ef686caf0103866339452d3d1c4fb",
                    "data": {
                        "malware_family_profile_uid": "b38ef686caf0103866339452d3d1c4fb",
                        "family": "dridex"
                    }
                },
                "expiration": 1622192350000,
                "confidence": "medium",
                "context": {
                    "description": "plugin downloaded by dridex malware family"
                },
                "mitre_tactics": "stage_capabilities",
                "indicator_type": "file",
                "indicator_data": {
                    "file": {
                        "md5": "c444f89248e673d3bc22ed125c4ed162",
                        "sha1": "c652139e29b209757d497e026bfc187ef3bfadc7",
                        "sha256": "cd7bc57e2d614137de1594ac0b04004b936797f0e5b402ace3e75a7138e61370",
                        "type": "PEDLL_x86",
                        "size": 382976,
                        "download_url": "https://api.intel471.com/v1/download/malwareIntel/cd7bc57e2d614137de1594ac0b04004b936797f0e5b402ace3e75a7138e61370.zip"
                    }
                },
                "intel_requirements": [
                    "1.3.4",
                    "1.1.4"
                ]
            },
            "meta": {
                "version": "0.1"
            },
            "last_updated": 1590656362056,
            "uid": "b366979d1abdedf51f985fe03d0fc19e",
            "activity": {
                "first": 1590503428000,
                "last": 1590656350000
            }
        }
    ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.2.0
  • Updated the endpoint to use the streaming API. 
  • Removed the Count user configuration option.   
• Version 1.1.1
  • Fixed feed name typo.
• Version 1.1.0
  • Added ability to ingest all indicator types at once.
• Version 1.0.0
  • Initial release.