Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Intel 471 Compromised Credentials CDF integration for ThreatQ allows you to track your organization's compromised credentials in order to efficiently mitigate any threats targeting your organization's employees.

The integration provides the following feed:

• Intel 471 Compromised Credentials - imports compromised credentials from Intel 471's API in order to track internal credentials that have been compromised.

The integration ingests the following system objects:

• Compromised Accounts
  • Compromised Account Attributes
• Indicators
  • Indicator Attributes
• Malware

Prerequisites

The integration requires the following:

• Your Intel 471 Client ID and Secret.
• Compromised Account custom object installed on the ThreatQ instance.  

Compromised Account Custom Object

The integration requires the Compromised Account custom object.  

Use the steps provided to install the Compromised Account custom object.    

When installing the custom objects, be aware that any in-progress feed runs will be cancelled, and the API will be in maintenance mode.

Installation

The CDF requires the installation of the Compromised Account custom object before installing the actual CDF. See the Compromised Account section of this guide for more details.  The custom object must be installed prior to installing the CDF.  Attempting to install the CDF without the custom object will cause the CDF install process to fail.   

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration zip file.
3. Extract the integration files and install the Compromised Account custom object if you have not done so already.  
4. Navigate to the integrations management page on your ThreatQ instance.
5. Click on the Add New Integration button.
6. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

The feed will now be installed and added to the integrations page. You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Client ID	Enter your Intel 471 API Client ID.
   Client Secret	Enter your Intel 471 API Client Secret.
   Fetch GIR Names	Enable this parameter to fetch the GIR's name (example: 5.2.1 - initial Access Tactic).  Disable this parameter to fetch the GIR's raw format (example: 3.1.1).  This parameter is enabled by default.
   Ignore Numeric Credentials	Enable this parameter to skip ingestion of compromised credentials with usernames that consist solely of numeric values such as 721322.  This parameter is disabled by default.
   Context Filter	Select which pieces of context to ingest with the compromised credentials. Options include: Accessed URLs (Default) Compromised Tag (Default) Credential Sets (Default) Affected Site (Detection Domain) (Default) File Path Credential Domain Affiliations (Default) Password Strength Last Updated Last Seen Software Name Credential Type Infection Timestamp OS GIRs (Default) Associated Adversary (Default) Associated Malware Family (Default) Intel471 Verity Link
   Ingest Accessed URLs As	Select which entity type to ingest accessed URLs as. Options include: Indicators Attributes This parameter will only be accessible if you have selected the Accessed URLs option for the Context Filter parameter.
   Accessed URL Status	Select the status that should be applied to the accessed URLs. Options include: Review (Default) Active Indirect This parameter will only be accessible if you have selected the Indicators option for the Ingest Accessed URLs As parameter.
   Disable Proxies	Enable this option if the feed should not honor proxies set in the ThreatQ UI.
   Enable SSL Verification	Enable this parameter for the feed to validate the host-provided SSL certificate.  This option is enabled by default.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

Intel 471 Compromised Credentials

The Intel 471 Compromised Credentials feed imports compromised credentials from Intel 471's cloud API in order to track internal credentials that have been compromised.

GET https://api.intel471.cloud/integrations/creds/v1/credentials/occurrences/stream

Sample Response:

{
  "count": 1,
  "credential_occurrences": [
    {
      "id": "cred-occurrence--dc5e2ec0-bb5f-51dd-ab51-6a083f9bd61c",
      "data": {
        "file_path": "/2026-05-16/FE98AG723573_ISM/",
        "accessed_url": "http://acmecorp471.com/login.php",
        "credential": {
          "id": "cred--10aca35f-0d17-5880-952d-65ac76c3556d",
          "credential_login": "andrewgregory@acmecorp471-customers.com",
          "credential_domain": "acmecorp471-customers.com",
          "detection_domain": "acmecorp471-customers.com",
          "affiliations": [
            "my_customers"
          ],
          "password": {
            "strength": "weak",
            "id": "163d1a38"
          }
        },
        "credential_set": {
          "id": "cred-set--94c49f73-563d-54b8-9676-7620f6621acd",
          "name": "Information-stealer logs (DEMO ONGOING)"
        },
        "info_stealer": {
          "malware_family": "Arcane"
        }
      },
      "classification": {
        "girs": [
          {
            "path": "1.1.5",
            "name": "Information-stealer malware"
          },
          {
            "path": "4.2.2",
            "name": "Compromised credentials"
          }
        ]
      },
      "last_updated_ts": "2026-05-16T06:30:03.973Z",
      "activity": {
        "first_seen_ts": "2026-05-16T06:30:03.973Z",
        "last_seen_ts": "2026-05-16T06:30:03.973Z"
      }
    }
  ]
}

ThreatQuotient provides the following default mapping for this feed:

The mapping for this feed is based on each item within the .credential_occurrences array.

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 2.0.0
  • Migrated the primary feed to the Intel 471 Credentials Stream API endpoint: https://api.intel471.cloud/integrations/creds/v1/credentials/occurrences/stream.
  • Updated authentication to use Basic authentication with client_id and client_secret.

  • Updated feed query parameters to use last_updated_from, last_updated_until, size, and cursor for data retrieval and pagination.

  • Removed the supplemental GIR feed, as GIR names are now provided directly by the stream API through the classification.girs field.

  • Added support for ingesting the following additional attributes:
    • Last Updated
    • Last Seen
    • Software Name
    • Credential Type
    • Infection Timestamp
    • Operating System (OS)
• Version 1.1.2
  • Implemented indicator deduplication and enhanced data validation to resolve attribute ingestion failures.
• Version 1.1.1 rev-a
  • Guide Update - updated custom object installation steps for ThreatQ v6 instances.
• Version 1.1.1
  • Updated the integration to use the /credentials/occurrences/steam endpoint which supports Accessed URLs and removes the 1,000 credential return limit.  
• Version 1.1.0
  • Updated the feed to use the /credentials/occurrences endpoint.  
  • Updated the feed to optimize overall performance, ThreatQuotient integration standards, and to provide more granular control over the data ingested.  
  • Added the following configuration parameters:
    • Fetch Accessed URLs - fetches the accessed URLs for each compromised credential.
    • Fetch GIR Names - ability to select whether to fetch the GIR name or raw value.  
    • Ignore Numeric Credentials - ability to skip ingestion of compromised credentials with usernames that consist solely of numeric values.
    • Context Filter - allows you to select which pieces of context to ingest with the compromised credentials.
    • Ingest Accessed URLs As - allows you to determine whether to ingest accessed URLs as indicators or attributes.
    • Accessed URL Status - allows you to select the status that should be applied to the accessed URLs.
    • Disable Proxies - allows you to determine whether or not the feed honors the proxy configuration set in the ThreatQ UI.  
    • Enable SSL Verification - allows you to determine if the feed should validate the host-provided SSL certificate.  
  • Removed the Ingest Compromised Passwords as Attributes configuration parameter.  
• Version 1.0.0
  • Initial release