Integration Details

ThreatQuotient provides the following details for this integration:

Current Integration Version	1.0.2
Compatible with ThreatQ Versions	>= 4.0.0
Support Tier	ThreatQ Supported

Introduction

The URLScan.io Operation for ThreatQuotient enables a ThreatQ user to submit URLs to URLScan.io, as well as query URLScan.io for any results on a URL.

The operation provides the following actions:

• Search - queries URLScan.io for a specific indicator found in any public submission reports.
• Get Report - retrieves a report for any scan IDs found in the indicator's attributes.
• Submit - submits a URL or FQDN to URLScan.io. Once submitted, an attribute called "URLScan.io ID" will be added to the indicator.

The integration is compatible with the following indicator types:

• FQDN
• IP Address
• SHA-256
• URL

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Your URLScan.io API key.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The UrlScan.io operation provides the following actions:

Action	Description	Object Type	Object Subtype
Submit	Submits a URL or FQDN to URLScan.io. Once submitted, an attribute called "URLScan.io ID" will be added to the indicator	Indicator	FQDN, IP Address, URL
Get Reports	Retrieves a report for any scan IDs found in the indicator's attributes.	Indicator	FQDN, IP Address, URL
Search	Queries URLScan.io for a specific indicator found in any public submission reports.	Indicator	FQDN, IP Address,  SHA-256, URL

Submit

The Submit action will submit a URL or FQDN to URLScan.io. Once submitted, an attribute called "URLScan.io ID" will be added to the indicator.

Parameters

The following parameters are available for the Submit action:

Parameter	Description
Public	Select whether the scan will be publicly visable.  This option is not enabled by default.
Tags	Enter one or more tags, in line-separated format, to be added to the submission.

Example

Get Reports

The Get Reports action will retrieve a report for any scan IDs found in the indicator's attributes (see the Submit action).

Example

Search

The Search action queries URLScan.io for a specific indicator found in any public submission reports.

Example - Single Result

Example - Multiple Results

Change Log

• Version 1.0.2
  • Corrected version number displayed after installation.
  • Fixed an issue where the schema was stripped from URLs.
  • Fixed an issue where the integration did not honor customer-set proxy configurations.
• Version 1.0.0
  • Initial release