Current ThreatQ Version Filter
 

ThreatMiner Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The ThreatMiner operation for ThreatQ provides enrichment data for indicators.

The operation provides the following actions based on indicator type:

  • IP DNS Lookup - returns WHOIS information for an IP or FQDN including related name servers, network CIDR Blocks, registrant, ASN, Emails and more.
  • Hash Lookup - returns WHOIS information, emails, related network traffic, domains, hosts, mutants, registry keys and anti-virus Detections.
  • Email Lookup - returns related domains associated with emails.
  • Samples Lookup - returns related APT notes and samples.

The operation is compatible with the following indicator types:

  • Email Address
  • Filename
  • FQDN
  • IP Address
  • MD5
  • Mutex
  • Registry Key
  • SHA-1
  • SHA-256
  • SHA-384
  • SHA-512
  • User-Agent
  • URL Path

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the Operation option from the Type dropdown (optional).
  3. Click on the integration entry to open its details page.
  4. Review any additional settings, make any changes if needed, and click on Save.
  5. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following actions:

Action Description Object Type Object Subtype
IP DNS Lookup WHOIS information for an IP or FQDN including related name servers, network CIDR Blocks, registrant, ASN, Emails and more. Indicators IP Address, FQDN
Hash Lookup WHOIS information, emails, related network traffic, domains, hosts, mutants, registry keys and anti-virus Detections. Indicators MD5, SHA-1, SHA-256, SHA-384, SHA-512
Email Lookup Related domains associated with emails. Indicators Email Address
Sample Lookup Related APT notes and samples. Indicators Filename, Mutex, Registry Key, URL Path, User-agent

Change Log

  • Version 1.0.1
    • N/A
  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
ThreatMiner Operation Guide v1.0.1 3.6.0 or Greater
ThreatMiner Operation Guide v1.0.0 3.6.0 or Greater