Current ThreatQ Version Filter

Augur Security Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Augur Security Operation enriches ThreatQ indicators with context from the Augur Security API.

The integration provides the following operation actions:

  • Enrich FQDN - enriches an FQDN with Augur Security context.
  • Enrich IP Address - enriches an IP address with Augur Security data.
  • Enrich File Hash - enriches a file hash with Augur Security data.
  • Enrich CIDR - enriches a CIDR block with Augur Security data.

The integration is compatible with the following indicator types:

  • FQDN
  • IP Address
  • MD5
  • SHA-1
  • SHA-256
  • CIDR Block

Prerequisites

The following is required to install and run the integration:

  • An Augur Security API Key. 

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

  1. Log into https://marketplace.threatq.com/.
  2. Locate and download the integration file.
  3. Navigate to the integrations management page on your ThreatQ instance.
  4. Click on the Add New Integration button.
  5. Upload the integration file using one of the following methods:
    • Drag and drop the file into the dialog box
    • Select Click to Browse to locate the integration file on your local machine

    ThreatQ will inform you if the operation already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the operation contains changes to the user configuration. The new user configurations will overwrite the existing ones for the operation and will require user confirmation before proceeding.

The operation is now installed and will be displayed in the ThreatQ UI. You will still need to configure and then enable the operation.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the Operation option from the Type dropdown (optional).
  3. Click on the integration entry to open its details page.
  4. Enter the following parameters under the Configuration tab:
    Parameter Description
    API Key Enter your API key from Augur Security to authenticate.
    Automatically Create Related Objects Enable this parameter to create and link related adversaries and malware returned by Augur Security. This parameter is disabled by default. 
    Automatically Link Existing MITRE ATT&CK Patterns Enable this parameter to link techniques to matching Attack Patterns already present in ThreatQ. Missing patterns are not created.  This parameter is disabled by default.
  5. Review any additional settings, make any changes if needed, and click on Save.
  6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following actions:

Action Description Object Type Object Subtype
Enrich FQDN Enriches an FQDN with Augur Security context. Indicator FQDN
Enrich IP Address Enriches an IP address with Augur Security data. Indicator IP Address
Enrich File Hash Enriches a file hash with Augur Security data. Indicator MD5, SHA-1, SHA-256
Enrich CIDR Enriches a CIDR block with Augur Security data. Indicator CIDR Block

All actions send the API key in the access_token query parameter and request the following fields:

accessed_by_files,connections,country,asn,global_threat_context,rir,whitelist,whois,services,prediction,dga,mitre_attack

Enrich FQDN

The Enrich FQDN operation action enriches an FQDN with Augur Security context.

GET https://api.seclytics.com/domains/{value}

Sample Response:

{
  "dga": {
    "is_dga": false,
    "score": 10.330380869855674
  },
  "global_threat_context": {
    "actors": [
      {
        "description": "HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY",
        "human_readable": "G0032"
      }
    ],
    "categories": ["malicious", "malware"],
    "feeds": [
      {
        "name": "maltrail_malware"
      }
    ],
    "malware_families": [
      {
        "human_readable": "akdoortea"
      }
    ],
    "paths": ["/"],
    "references": [
      "https://github.com/eset/malware-ioc/tree/master/deceptivedevelopment"
    ],
    "sha1": ["39998442e77cd828207bea64fda16cc8226034b5"],
    "source_urls": [
      "https://github.com/stamparm/maltrail/blob/master/trails/static/malware/apt_lazarus.txt"
    ],
    "urls": ["http://driverservices.store/"]
  }
}

Enrich IP Address

The Enrich IP Address operation action enriches an IP address with Augur Security data.

GET https://api.seclytics.com/ips/{value}

Sample Response:

{
  "asn": {
    "description": "CLOUDFLARENET - Cloudflare, Inc.",
    "number": "13335"
  },
  "cidr": {
    "block": "45.146.130.0/24",
    "size": 256,
    "status": "announced"
  },
  "country": {
    "code": "US",
    "name": "United States"
  },
  "global_threat_context": {
    "actors": [
      {
        "human_readable": "Naikon"
      }
    ],
    "categories": ["malicious", "malware", "spam"],
    "feeds": [
      {
        "name": "spamhaus"
      }
    ],
    "malware_families": [
      {
        "human_readable": "odyssey stealer"
      }
    ]
  },
  "ip": {
    "type": "global"
  },
  "predicted": {
    "category": "malware",
    "cidr": "45.146.130.0/24",
    "cluster": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "importance": 80,
    "predicted_at": "2025-07-15T08:17:57",
    "prediction_id": 927089,
    "profile": "profile-133688",
    "valid_from": "2025-07-14T07:13:56",
    "valid_until": null
  },
  "rir": {
    "code": "AR",
    "name": "ARIN"
  },
  "services": {
    "is_hosting": true
  },
  "whitelist": "Cloudflare CDN",
  "whois": [
    {
      "admin_c": "DUMY-RIPE",
      "country": {
        "name": "Cambodia"
      },
      "created_at": "2025-07-14T07:13:56",
      "description": "cf-validation: 629698c0-c3c8-4c16-9f14-98c89089a273",
      "name": "CloudFlare",
      "org": "ORG-PRDS1-RIPE",
      "registry": "RIPE",
      "status": "ASSIGNED PA",
      "tech_c": "DUMY-RIPE",
      "updated_at": "2025-12-22T09:38:25"
    }
  ]
}

Enrich File Hash

The Enrich File Hash operation action enriches a file hash with Augur Security data.

GET https://api.seclytics.com/files/{value}

Sample Response:

{
  "connections": [
    {
      "id": "1.1.1.1",
      "type": "ip",
      "whitelist": "dns"
    }
  ],
  "global_threat_context": {
    "categories": ["malicious"],
    "feeds": [
      {
        "name": "hybrid_analysis"
      }
    ],
    "file_types": ["pe32+ executable (gui) x86-64, for ms windows, 10  ..."],
    "ips": ["1.1.1.1"],
    "md5": ["7d4f433b9c751c0a12471d387c16001d"],
    "names": ["5d5eaf60c97e.exe"],
    "sha1": ["2c202985fd55fc53383a89a773f0dcd3c98d6a91"],
    "sha256": [
      "bcb432d0d83df23e27517ab03e9701f5b48ea370d203881581ed3654c6216d59"
    ],
    "source_urls": [
      "https://www.hybrid-analysis.com/sample/bcb432d0d83df23e27517ab03e9701f5b48ea370d203881581ed3654c6216d59/6890dd31f0b2f1f6fb005418"
    ],
    "ssdeep": [
      "196608:oavycb3ebme2gggfj9+woj1xgp3ebme2gggfj9+woj1xg:oavz3ip+wse3ip+ws"
    ]
  },
  "hash_type": "sha256"
}

Enrich CIDR

The Enrich CIDR operation action enriches a CIDR block with Augur Security data.

GET https://api.seclytics.com/cidrs/{value}

Sample Response:

{
  "asn": {
    "description": "CLOUDFLARENET - Cloudflare, Inc.",
    "number": "13335"
  },
  "cidr": {
    "block": "45.146.130.0/24",
    "infection_percent": "100.0",
    "size": 256,
    "status": "announced"
  },
  "country": {
    "code": "US",
    "name": "United States"
  },
  "global_threat_context": {
    "categories": ["backscatter", "malicious", "proxy", "scanner", "spam"],
    "feeds": [
      {
        "name": "dshield_daily_sources"
      }
    ],
    "ips": ["45.146.130.1", "45.146.130.136"]
  },
  "predicted": {
    "category": "malware",
    "cidr": "45.146.130.0/24",
    "cluster": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "importance": 80,
    "predicted_at": "2025-07-15T08:17:57",
    "prediction_id": 927089,
    "profile": "profile-133688",
    "valid_from": "2025-07-14T07:13:56",
    "valid_until": null
  },
  "rir": {
    "code": "AR",
    "name": "ARIN"
  },
  "connections": [
    {
      "id": "45.146.130.136",
      "type": "ip",
      "whitelist": "Cloudflare CDN"
    }
  ]
}

Data Mapping (all)

ThreatQuotient provides the following default mapping for this all operation actions:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Published Date Examples Notes
.seclytics_score, .dga.score, or .score Indicator.Attribute Seclytics Score N/A 10.330380869855674 The first available value is used.
.dga.is_dga Indicator.Attribute Is DGA N/A false N/A
.global_threat_context.categories[] Indicator.Attribute Category N/A malicious N/A
.global_threat_context.feeds[] Indicator.Attribute Source Feed N/A maltrail_malware Uses human_readable, name, or value for object values.
.global_threat_context.references[] Indicator.Attribute Reference N/A https://github.com/eset/malware-ioc/ N/A
.global_threat_context.source_urls[] Indicator.Attribute Source URL N/A https://github.com/stamparm/maltrail/ N/A
.global_threat_context.paths[] Indicator.Attribute Observed Path N/A / N/A
.country.name Indicator.Attribute Country N/A United States N/A
.country.code Indicator.Attribute Country Code N/A US N/A
.rir.name Indicator.Attribute RIR N/A ARIN N/A
.rir.code Indicator.Attribute RIR Code N/A AR N/A
.asn.number Indicator.Attribute ASN N/A 13335 N/A
.asn.description Indicator.Attribute AS Organization N/A CLOUDFLARENET - Cloudflare, Inc. N/A
.cidr.block Indicator.Attribute CIDR Block N/A 45.146.130.0/24 N/A
.cidr.size Indicator.Attribute CIDR Size N/A 256 N/A
.cidr.status Indicator.Attribute CIDR Status N/A announced N/A
.cidr.infection_percent Indicator.Attribute CIDR Infection Percentage N/A 100.0 N/A
.ip.type Indicator.Attribute IP Scope N/A global N/A
.predicted.category or .prediction.category Indicator.Attribute Predicted Category N/A malware N/A
.predicted.importance or .prediction.importance Indicator.Attribute Predicted Importance N/A 80 N/A
.predicted.predicted_at or .prediction.predicted_at Indicator.Attribute Predicted At N/A 2025-07-15T08:17:57 N/A
.predicted.valid_from or .prediction.valid_from Indicator.Attribute Prediction Valid From N/A 2025-07-14T07:13:56 N/A
.predicted.valid_until or .prediction.valid_until Indicator.Attribute Prediction Valid Until N/A N/A Null values are omitted.
.predicted.profile or .prediction.profile Indicator.Attribute Prediction Profile N/A profile-133688 N/A
.predicted.cidr or .prediction.cidr Indicator.Attribute Predicted CIDR N/A 45.146.130.0/24 N/A
.predicted.cluster or .prediction.cluster Indicator.Attribute Prediction Cluster N/A da39a3ee5e6b4b0d3255bfef95601890afd80709 N/A
.predicted.prediction_id or .prediction.prediction_id Indicator.Attribute Prediction ID N/A 927089 N/A
.whitelist Indicator.Attribute Whitelist Reason N/A Cloudflare CDN N/A
.hash_type Indicator.Attribute Hash Type N/A sha256 N/A
.global_threat_context.file_types[] Indicator.Attribute File Type N/A pe32+ executable N/A
.services.is_hosting Indicator.Attribute Service Flag N/A Hosting Added only when the value is true.
.services.is_anycast Indicator.Attribute Service Flag N/A Anycast Added only when the value is true.
.services.is_mobile Indicator.Attribute Service Flag N/A Mobile Added only when the value is true.
.services.is_satellite Indicator.Attribute Service Flag N/A Satellite Added only when the value is true.
.services.anonymous.name Indicator.Attribute Anonymizer Service N/A N/A N/A
.services.anonymous.is_relay Indicator.Attribute Service Flag N/A Relay Added only when the value is true.
.services.anonymous.is_proxy Indicator.Attribute Service Flag N/A Proxy Added only when the value is true.
.services.anonymous.is_tor Indicator.Attribute Service Flag N/A Tor Added only when the value is true.
.services.anonymous.is_vpn Indicator.Attribute Service Flag N/A VPN Added only when the value is true.
.whois[-1].registry Indicator.Attribute Registry N/A RIPE The final WHOIS record is used.
.whois[-1].name Indicator.Attribute Registrant Name N/A CloudFlare The final WHOIS record is used.
.whois[-1].org Indicator.Attribute Registrant Organization N/A ORG-PRDS1-RIPE The final WHOIS record is used.
.whois[-1].country.name Indicator.Attribute Registrant Country N/A Cambodia The final WHOIS record is used.
.whois[-1].city Indicator.Attribute Registrant City N/A N/A The final WHOIS record is used.
.whois[-1].status Indicator.Attribute Registrant Status N/A ASSIGNED PA The final WHOIS record is used.
.whois[-1].description Indicator.Attribute WHOIS Description N/A cf-validation: 629698c0... The final WHOIS record is used.
.whois[-1].owner_c Indicator.Attribute Owner Contact N/A N/A The final WHOIS record is used.
.whois[-1].admin_c Indicator.Attribute Admin Contact N/A DUMY-RIPE The final WHOIS record is used.
.whois[-1].abuse_c Indicator.Attribute Abuse Contact N/A N/A The final WHOIS record is used.
.whois[-1].tech_c Indicator.Attribute Technical Contact N/A DUMY-RIPE The final WHOIS record is used.
.whois[-1].created_at Indicator.Attribute WHOIS Creation Date N/A 2025-07-14T07:13:56 The final WHOIS record is used.
.whois[-1].updated_at Indicator.Attribute WHOIS Updated Date N/A 2025-12-22T09:38:25 The final WHOIS record is used.
.global_threat_context.actors[].human_readable or .name Related Adversary.Name N/A N/A Lazarus Group Displayed read-only; optionally created and linked automatically.
.global_threat_context.actors[].description Related Adversary.Description N/A N/A HIDDEN COBRA, Guardians of Peace Displayed read-only; optionally created and linked automatically.
.global_threat_context.malware_families[].human_readable or .name Related Malware.Value or Related Tool.Value N/A N/A BeaverTail Metasploit and Meterpreter are displayed as Tools.
.global_threat_context.malware_families[].description Related Malware.Description or Related Tool.Description N/A N/A AkdoorTea is a simple TCP RAT. Malware can be created automatically; Tools remain read-only.
.global_threat_context.hostnames[] Related Indicator.Value FQDN N/A N/A N/A
.global_threat_context.ips[] Related Indicator.Value IP Address or IPv6 Address N/A 1.1.1.1 N/A
.global_threat_context.urls[] Related Indicator.Value URL N/A http://driverservices.store/ N/A
.global_threat_context.names[] Related Indicator.Value Filename N/A 5d5eaf60c97e.exe N/A
.global_threat_context.md5[] Related Indicator.Value MD5 N/A 7d4f433b9c751c0a12471d387c16001d N/A
.global_threat_context.sha1[] Related Indicator.Value SHA-1 N/A 2c202985fd55fc53383a89a773f0dcd3c98d6a91 N/A
.global_threat_context.sha256[] Related Indicator.Value SHA-256 N/A bcb432d0d83df23e27517ab03e9701f5b48ea370d203881581ed3654c6216d59 N/A
.global_threat_context.sha512[] Related Indicator.Value SHA-512 N/A N/A N/A
.global_threat_context.ssdeep[] Related Indicator.Value Fuzzy Hash N/A 196608:oavycb3ebme2gggf... N/A
.global_threat_context.vulnerabilities[] Related Indicator.Value CVE N/A N/A Values without a CVE- prefix are ignored.
.accessed_by_files[] Related Indicator.Value MD5, SHA-1, SHA-256, or SHA-512 N/A N/A Hash type is determined by value length.
.connections[].id and .connections[].whitelist Related Indicator.Status and Attribute Whitelisted; Whitelist Reason N/A Cloudflare CDN Applied when the connection ID matches a related indicator.
.mitre_attack[].id or .mitre_attack[].number Related Attack Pattern.Value N/A N/A N/A Displayed read-only; optionally links a matching existing ThreatQ Attack Pattern by technique ID.
.mitre_attack[].name or .mitre_attack[].title Related Attack Pattern.Value N/A N/A N/A Combined with the technique ID for display.
.mitre_attack[].description Attack Pattern display Description N/A N/A Displayed but not added to the existing Attack Pattern.
.mitre_attack[].tactic_name or .mitre_attack[].stage Attack Pattern display Tactic N/A N/A Displayed but not added to the Attack Pattern.
.mitre_attack[].url Attack Pattern display Reference N/A N/A Displayed but not added to the Attack Pattern.

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
Augus Security Operation Guide v1.0.0 5.12.1 or Greater