Integration Details

ThreatQuotient provides the following details for this integration:

Current Integration Version	1.0.0
Compatible with ThreatQ Versions	>= 4.15.0
Support Tier	ThreatQ Supported

Introduction

www.blocklist.de is a free and voluntary service provided by a Fraud/Abuse-specialist, whose servers are often attacked via SSH-, Mail-Login-, FTP-, Webserver- and other services.

The bloclist.de CDF provides the following feeds:

• blocklist.de (All)
• blocklist.de (Apache)
• blocklist.de (Bots)
• blocklist.de (Bruteforcelogin)
• blocklist.de (Ftp)
• blocklist.de (Imap)
• blocklist.de (Ircbot)
• blocklist.de (Mail)
• blocklist.de (Sip)
• blocklist.de (Ssh)
• blocklist.de (Strongips)

The integration ingests indicator system objects.   

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the OSINT option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Review feeds settings, make any changes if needed, and click on Save.
5. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

All Feeds

All 11 feeds included in the CDF follow the same plain text file with a single IP Address per line format.

Sample Response:

1.119.14.83
1.119.198.206
1.161.221.154

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Published Date	Examples	Notes
0 (first token)	Indicator	IP Address		1.119.14.83

Change Log

• Version 1.0.0
  • Initial release