Integration Details

ThreatQuotient provides the following details for this integration:

Current Integration Version	1.0.0
Compatible with ThreatQ Versions	>= 4.0.0
Support Tier	Not Actively Supported

Introduction

The Silobreaker Operation for ThreatQ enables a user to query Silobreaker for any reputation context for a given indicator of compromise.

The operation provides the following actions:

• In Focus - queries Silobreaker for the top 'x' related entities for a given entity.
• Heat - queries Silobreaker for the most recent documents pertaining to an
  entity and its' related entities

The operation is compatible with the following system objects:

• Adversaries
• Identities
• Indicators
  • URL
  • FQDN
  • IP Address
  • CVE
  • MD5
  • SHA-1
  • SHA-256
  • Username
  • ASN
• Malware
• TTPs
• Vulnerabilities

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Your Silobreaker API Key.
   Shared Key	Your Silobreaker Shared Key.
   Count Per Entity Type	The number of each entity type you'd like returned. The default setting is 10.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following actions:

Action	Description	Object Type	Object Subtype
In Focus	Queries Silobreaker for the top 'x' related entities for a given entity such as a Threat Actor or Malware.	Adversaries, Identities, Indicators, Malware, TTPs, Vulnerabilities	Indicators - URL, FQDN, IP Address, CVE, MD5, SHA-1, SHA-256, Username, ASN
Heat	Queries Silobreaker for the most recent documents pertaining to an entity and its' related entities.	Adversaries, Identities, Indicators, Malware, TTPs, Vulnerabilities	Indicators - URL, FQDN, IP Address, CVE, MD5, SHA-1, SHA-256, Username, ASN

In Focus

The In Focus action queries Silobreaker for the top 'x' related entities for a given entity such as a Threat Actor or Malware.

Example Result

Heat

The In Focus action queries Silobreaker for the top 'x' related entities for a given entity such as a Threat Actor or Malware.

Action Parameters

Running the Heat action requires you to enter/confirm the following options:

Parameter	Description
Entity Types	Select which entity types you want to query.
Size	Enter how many, of each entity, to return.

Example Result

Change Log

• Version 1.0.0
  • Initial release