Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Spur tracks anonymization services so that you can identify when anonymization services are touching your website, application, or network.

The Spur Operation allows analysts to perform quick context lookups for a given IP Address, bringing back anonymization information that can be used to determine if the IOC is a possible threat.

The Get Context action enables the automatic enrichment of IP Addresses in ThreatQ, using Spur's Context API. The API will tell you if the selected IOCs are used by anonymization services, as well as if the tunnels are used by a specific region, or used by a specific threat.

The operation provides the following action:

• Get Context - returns the context information collected by Spur about the selected IP.

The operation is compatible with the following indicator types:

• IP Address
• IPv6 Address 

Prerequisites

The operation requires the following:

• A valid Spur API Key.  

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the integration file on your local machine

   ThreatQ will inform you if the operation already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the operation contains changes to the user configuration. The new user configurations will overwrite the existing ones for the operation and will require user confirmation before proceeding.

The operation is now installed and will be displayed in the ThreatQ UI. You will still need to configure and then enable the operation.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Spur Hostname or IP	The hostname or IP address for your Spur instance. The default value is api.spur.us.
   Spur API Key	Your Spur API Key.
   Verify SSL	Enable or Disable Host SSL certificate verification.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following action:

{
  "as": {
    "number": 30083,
    "organization": "AS-30083-GO-DADDY-COM-LLC"
  },
  "client": {
    "behaviors": ["TOR_PROXY_USER"],
    "concentration": {
      "city": "Weldon Spring",
      "country": "US",
      "density": 0.202,
      "geohash": "9yz",
      "skew": 45,
      "state": "Missouri"
    },
    "count": 14,
    "countries": 1,
    "proxies": ["LUMINATI_PROXY", "SHIFTER_PROXY"],
    "spread": 4941431,
    "types": ["MOBILE", "DESKTOP"]
  },
  "infrastructure": "DATACENTER",
  "ip": "148.72.164.186",
  "location": {
    "city": "St Louis",
    "country": "US",
    "state": "Missouri"
  },
  "risks": ["WEB_SCRAPING", "TUNNEL"],
  "services": ["IPSEC", "OPENVPN"],
  "tunnels": [
    {
      "anonymous": true,
      "entries": ["148.72.164.179"],
      "exits": ["148.72.164.177"],
      "operator": "NORD_VPN",
      "type": "VPN"
    }
  ]
}

Change Log

• Version 1.0.1
  • Added the following configurations parameters:
    • Spur Hostname or IP - allows you to specify the hostname or IP of your Spur instance.
    • SSL Verification - enable or disable Host SSL certificate verification.
• Version 1.0.0
  • Initial release