Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Recorded Future Compromised Credentials CDF integration enables ThreatQ to ingest identity exposure and compromised credential detections from Recorded Future’s Identity API into the ThreatQ platform. The integration is designed to help organizations identify, track, and operationalize compromised account intelligence by ingesting exposed credential data as structured threat intelligence objects within ThreatQ.

The integration provides the following feed:

• Recorded Future Compromised Credentials - ingests Compromised Account objects as the primary entity and, when enabled and available in the source data, ingests related Indicator objects associated with the compromised account.

The integration ingests the following system objects:

• Compromised Accounts (custom object)
• Indicators

Prerequisites

The following is required to install and run the integration:

• A Recored Future API Key.
• The Compromised Account custom object installed on your ThreatQ instance. This object must be installed prior to attempting to install the integration.

Compromised Account Custom Object

The integration requires the compromised account custom object.  

Use the steps provided to install the custom object.    

When installing the custom objects, be aware that any in-progress feed runs will be cancelled, and the API will be in maintenance mode.

Installation

The CDF requires the installation of the Compromised Account custom object before installing the actual CDF. See the Prerequisites chapter for more details. The custom object must be installed prior to installing the CDF. Attempting to install the CDF without the custom object will cause the CDF install process to fail.

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration zip file.
3. Extract the contents of the zip and install the required Compromised Card custom object.
4. Navigate to the integrations management page on your ThreatQ instance.
5. Click on the Add New Integration button.
6. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

The feed will be added to the integrations page. You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Enter your Recorded Future API Key.
   Organization IDs	Enter a line-separated list of Recorded Future organization IDs.
   Enable SSL Certificate Verification	Enable this parameter if the feed should validate the host-provided SSL certificate.
   Disable Proxies	Enable this parameter if the feed should not honor proxies set in the ThreatQ UI.
   Include Enterprise Level	Enable this parameter to include enterprise-level detections across all organizations. This parameter is enabled by default.
   Novel Detections Only	Enable this parameter to have the feed only return novel detections. This parameter is disabled by default.
   Malware Detections Only	Enable this parameter to have the feed only return malware-linked detections. This parameter is disabled by default.
   Domains	Optional - enter a line-separated list of domains to use with filter.domains.
   Detection Types	Optional - enter a line-separated list to use with filter.detection.types.
   Source Types	Optional - enter a line-separated list to use with filter.source.type.
   Detection Type	Optional - select the request body filter.detection_type value. Options include: All (default) Workforce External VIP
   Cookie Filter	Optional - select a value for filter.cookies. Options include: None (default) Cookies Unexpired Cookies
   Authorization Technology IDs	Optional - enter a line-separated list of Recorded Future authorization technology IDs.
   Authorization Technology Any	Enable this parameter to use any-match behavior for the authorization technology filter. This parameter is disabled by default. This option is available only when Authorization Technology IDs parameter is being used.
   Result Limit Per Request	Enter the maximum detections per request. Recorded Future allows up to 1000. The default value is 100.
   Account Context	Select which pieces of context are ingested with the compromised account. Options include: Detection ID (default) Detection Type (default) Source Type (default) Novel Flag (default) Password Type (default) Cleartext Hint (default) Password Properties (default) Authorization URL (default) Affected Domain (default) Authorization Protocols (default) Authorization Technologies (default) Dump Name (default) Dump Source (default) Dump Description (default) Dump Downloaded At (default) Dump Type (default) Dump City (default) Dump State (default) Dump Country (default) Dump Country Code (default) Breached Name (default) Breached Domain (default) Breached Type (default) Breached Date (default) Breached Start (default) Breached Stop (default) Breached Precision (default) Breached Description (default) Breached Site Description (default)
   Relate Password Hashes as Indicators	Enable this parameter to ingest password hashes as indicators related to the compromised account. This parameter is enabled by default.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

Recoded Future Compromised Credentials

The Recorded Future Compromised Credentials feed imports compromised credential detections from Recorded Future’s Identity API and represents each detection as a Compromised Account object within ThreatQ. Related dump, breach, password, and authorization service context is mapped as attributes on the compromised account. Password hashes can also be optionally ingested as related indicator objects.

POST https://api.recordedfuture.com/identity/detections

Sample Body:

{
  "organization_id": [
    "uhash:ER135KQ6oL"
  ],
  "include_enterprise_level": true,
  "filter": {
    "novel_only": false,
    "malware_only": false,
    "domains": [],
    "detection_types": [],
    "source_type": [],
    "created": {
      "gte": "2020-01-07T04:16:18.116Z",
      "lt": "2026-05-14T04:16:18.116Z"
    },
    "detection_type": ""
  },
  "limit": 100
}

Sample Response (truncated):

{
    "total": 1,
    "detections": [
        {
            "id": "aaad1a4d93d8cee51b3fc877125d3971",
            "novel": true,
            "type": "Workforce",
            "source_type": "MalwareCombolists",
            "subject": "jerry.wu@threatq.com",
            "password": {
                "type": "clear",
                "cleartext_hint": "Un",
                "properties": [
                    "Letter",
                    "Number"
                ],
                "hashes": [
                    {
                        "algorithm": "SHA1",
                        "hash": "5d74bb0119d26a9f83789213055e8acfe05b786c"
                    },
                    {
                        "algorithm": "SHA256",
                        "hash":
                            "aeec637ef53bc1d3a601c1271b95e26a69088ed7db7a4879aaab235f6719f927"
                    }
                ]
            },
            "authorization_service": {
                "url": "https://threatq.okta.com",
                "domain": "okta.com",
                "fqdn": "threatq.okta.com",
                "protocols": [
                    "https"
                ],
                "technology": [
                    {
                        "name": "Authentication"
                    },
                    {
                        "name": "Okta"
                    }
                ]
            },
            "dump": {
                "name": "Pure Incubation Ventures Dump 2024",
                "source": "dump:pureincubation/",
                "description":
                    "The database includes customer and company identification (ID) numbers,"
                    " full names, email and physical addresses, phone numbers, hashed "
                    "passwords, company email domains, company names, company sizes, "
                    "company revenues, industries, job titles, and more",
                "downloaded": "2024-09-27T13:09:06.299Z",
                "type": "TextDataDump",
                "breaches": [
                    {
                        "name": "Pure Incubation Ventures Breached 2024",
                        "domain": "pureincubationventures.com",
                        "type": "Breach",
                        "breached": "2024-01-31T22:00:00.000Z",
                        "start": "2024-01-31T22:00:00.000Z",
                        "stop": "2024-02-29T21:59:59.000Z",
                        "precision": "month",
                        "description":
                            "On 15 August, 2024, KryptonZombie, a member of BreachForums 2, "
                            "shared a data set containing credentials from Pure Incubation "
                            "Ventures (pureincubationventures.com), a specialized investment "
                            "firm focused on providing financial and operational expertise to "
                            "technology companies.",
                        "site_description":
                            "a specialized investment firm focused on providing financial "
                            "and operational expertise to technology companies"
                    }
                ],
                "location": {
                    "country": {
                        "name": "United States of America (the)",
                        "displayName": "United States of America",
                        "countryCode": "840",
                        "alpha2Code": "US",
                        "alpha3Code": "USA"
                    },
                    "city": "Reston",
                    "address1": "11400 Commerce Park Dr Ste 200",
                    "state": "VA",
                    "zip": "20191"
                }
            },
            "created": "2026-04-01T00:00:00.000Z"
        }
    ]
}

ThreatQuotient provides the following default mapping for this feed:

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.0.0
  • Initial release