Export Details

ThreatQuotient provides the following details for this export:

Introduction

ThreatQuotient makes it easy for customers to export Netwitness indicators for use with an external threat detection system.

The following export data will be used:

• FQDN
• IP Address

Creating the Export

The following section will detail how to create exports for FDQN and IP Addresses.

See the Managing Exports topic for more details on ThreatQ exports.  

Exporting to Netwitness FQDN

1. Select the Settings icon > Exports.

   The Exports page appears with a table listing all exports in alphabetical order.

2. Click Add New Export

   The Connection Settings dialog box appears.

3. Enter an Export Name.
4. Click Next Step.

   The Output Format dialog box appears.

5. Provide the following information:

   Field	Value
   Which type of information would you like to export?	Indicators
   Output Type	text/csv; charset=utf-8
   Special Parameters	indicator.status=Active&indicator.deleted=N& indicator.type=FQDN&indicator.class=network
   Output Template	{foreach $data as $indicator} "{$indicator.value}","{foreach $indicator.Sources as $source}{$source.value}, {foreachelse}{/foreach}","https://{$http_host}/indicators/{$indicator.id}/details" {/foreach}

6. Click on Save Settings and enable the export via the On/Off toggle switch.

Exporting to Netwitness IP

1. Select the Settings icon > Exports.

   The Exports page appears with a table listing all exports in alphabetical order.

2. Click Add New Export

   The Connection Settings dialog box appears.

3. Enter an Export Name.
4. Click Next Step.

   The Output Format dialog box appears.

5. Provide the following information:

   Field	Value
   Which type of information would you like to export?	Indicators
   Output Type	text/csv; charset=utf-8
   Special Parameters	indicator.status=Active&indicator. deleted=N&indicator.type=IP Address&indicator.class=network
   Output Template	{foreach $data as $indicator} "{$indicator.value}","{foreach $indicator.Sources as $source}{$source.value},{foreachelse}{/foreach}","https://{$http_host}/indicators/{$indicator.id}/details" {/foreach}

6. Click on Save Settings and enable the export via the On/Off toggle switch.

Change Log

• Version 1.0.0
  • Initial release