Current ThreatQ Version Filter
 

VXVault URL CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The VXVault URL CDF for ThreatQ retrieves a list of malicious URLs.

The integration provides the following endpoint:

  • VXVault URL - retrieves a list of URLs and ingests them as indicators into the ThreatQ platform.

The integration ingests indicators and indicator attributes into the ThreatQ platform.

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the OSINT option from the Category dropdown (optional).

    If you are installing the integration for the first time, it will be located under the Disabled tab.

  3. Click on the integration entry to open its details page.
  4. Review any additional settings, make any changes if needed, and click on Save.
  5. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

VXVault URL

The VXVault URL feed retrieves a list of URLs and ingests them as indicators into ThreatQ.

GET http://vxvault.net/URL_List.php

Sample Response:

http://91.243.44.99/rev-Hehtcbz.png
http://20.51.217.113/hub/Ngsvpxd.log
http://20.51.217.113/fc/Xxzjxsyby.exe
http://20.51.217.113/ome/Xxzjxsyby.jpg
http://integralbd.com/inquiry-cim.jpg
http://94.250.249.239/Software/02015/FreeMatPortable_4_3_English.jpg
https://scottbyscott.com/obino/obs.png
https://store1.gofile.io/download/9c3dfe5f-3155-44f2-98f2-24ce360b1f7a/winit.exe
http://integralbd.com/Ematlm.jpg

ThreatQ provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Examples Notes
1 (first token) Indicator.Value URL http://91.243.44.99/rev-Hehtcbz.png N/A

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Metric Result
Run Time 3 minutes
Indicators 100
Indicators Attributes 100

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
VXVault URL CDF Guide v1.0.0 4.0.0 or Greater