Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

IntelFinder is operated by Inteller ltd, an expert in web intelligence automation. They productized their proprietary technology, which has been used to serve Fortune 500 companies and government agencies for over 5 years, to create the world’s first fully automated and scalable threat intelligence solution.

The IntelFinder CDF provides the following feed:

• IntelFinder Alerts - https://dash.intelfinder.io/api.php

The CDF ingests reports and report attributes into the ThreatQ platform.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameter under the Configuration tab:

   Parameter	Description
   API Key	The IntelFinder API Key for the account whose alerts will be fetched.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
  "code": 0,
  "alerts_number": 1,
  "alerts": [
    {
      "_id": "5d9dd07c1d41c80c1864b4a6",
      "subscription": "Domain Expiration",
      "priority": 3,
      "status": 1,
      "added_on": "2019-10-05 12:15:12",
      "last_update": "2019-10-05 12:15:12",
      "keyword": "google.com",
      "title": "A Domain is About to Expire",
      "description": "Please note that one of your domains is about to expire.",
      "details": "%elements%",
      "recommendation": "We recommend renewing the domain.",
      "base_elements": [
        {
          "label": "Domain",
          "value": "google.com"
        },
        {
          "label": "Expiration Date",
          "value": "September 30th, 2019"
        }
      ],
      "comments": [],
      "updates": [],
      "elements": [
        {
          "label": "Domain",
          "value": "google.com"
        },
        {
          "label": "Expiration Date",
          "value": "September 30th, 2019"
        }
      ]
    }
  ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

IntelFinder Alerts

Change Log

• Version 1.0.0
  • Initial release