Export Details

ThreatQuotient provides the following details for this export:

Introduction

This guide explains how to export Tenable indicators for use with an external threat detection system.  The steps provided are for exporting the following Tenable indicator types:

• Tenable FQDN
• Tenable IP Address
• Tenable MD5 Address

Creating the Export

The following section will detail how to create the exports in ThreatQ.

See the Managing Exports topic for more details on ThreatQ exports.  

1. Select the Settings icon > Exports.

   The Exports page appears with a table listing all exports in alphabetical order.

2. Click Add New Export

   The Connection Settings dialog box appears.

3. Enter an Export Name.
4. Click Next Step.

   The Output Format dialog box appears.

5. Provide the following information based on the type of indicator:

   Tenable FQDNs

   Field	Value
   Type of information you would like to export?	Indicators
   Output type	text/plain
   Special Parameters	indicator.status=Active&indicator.deleted=N&indicator. type=FQDN&indicator.class=network
   Output Template	{foreach $data as $indicator} {$indicator.value},{foreach $indicator.Sources item=source name=Sources} {$source.value}{if $smarty.foreach.Sources.last == false}/{/if}{/foreach} {/foreach}

   Tenable IP Address

   Field	Value
   Type of information you would like to export?	Indicators
   Output type	text/plain
   Special Parameters	indicator.status=Active&indicator.deleted=N&indicator. type=IP Address&indicator.class=network
   Output Template	{foreach $data as $indicator} {$indicator.value},{foreach $indicator.Sources item=source name=Sources} {$source.value}{if $smarty.foreach.Sources.last == false}/{/if}{/foreach} {/foreach}

   Tenable MD5 Address

   Field	Value
   Type of information you would like to export?	Indicators
   Output type	text/plain
   Special Parameters	indicator.status=Active&indicator.deleted=N&indicator.type=MD5&indicator.class=network
   Output Template	{foreach $data as $indicator} {$indicator.value},{foreach $indicator.Sources item=source name=Sources} {$source.value}{if $smarty.foreach.Sources.last == false}/{/if}{/foreach} {/foreach} This will strip the port and URL path from the IOCs.

6. Click on Save Settings and enable the export via the On/Off toggle switch.

Change Log

• Version 1.0.0
  • Initial release