Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The RST Report Hub is an electronic library of threat reports from hundreds of security companies, individual researchers, and cyber communities.

These reports undergo transformation from human-readable formats to machine-readable ones, including STIX 2.1. Extensive multilingual translation, archiving as PDFs, and summarization are conducted. Key data, encompassing threat actors, names, software, CVEs, geolocation, industry, etc., is automatically extracted, with due credit to the original report author.

This guide will provide you with the steps to install the following RST Report HUB TAXII feed:

• RST Report HUB

This feed is a TAXII feed and does not require installation files from the ThreatQ Marketplace.  

Prerequisites

You will need to the following to install and utilize the RST Report HUB TAXII Feed:

• RST Cloud Account

You can contact RST Cloud Support to receive a custom RST REport Hub collection.  

Setting up the TAXII Feeds

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To set up and configure the TAXII feeds:

1. Navigate to your integrations management page in ThreatQ.
2. Click on the Add New Integration button and select the Add New TAXII Feed option.
3. Enter the following feed settings:

   Parameter	Description
   What would you like to name this feed	Enter RST Report HUB as the feed name.
   How ofter would you like to pull new data from this feed	Select the frequency in which the feed it pulled.  Options include: Every Hour Every6 Hours Every Day Every 2 Days Every 14 Days Every 30 Days
   TAXII Server Version	Select the 2.1 option from the dropdown menu.
   Discovery URL	Enter the Discovery URL: https://taxii.rstcloud.net/taxii2/
   Poll URL	Enter the Poll URL https://taxii.rstcloud.net/taxii2/root/collections/a194a4a6-1d59-4c75-a622-e4a1766e9120
   Collection Name/Title	Enter RST Report HUB as the collection name.
   Disable Proxies	Leave this option unselected.
   Username	Enter your RST Cloud username.
   Password	Enter your RST Cloud password.
   Verify SSL	Enable this parameter for the feed to verify the provider's certificate.  The certificate can be found at https://taxii.rstcloud.net/.
   Host CA Certificate Bundle	If you enabled the Verify SSL configuration field, copy the certificate you obtained from https://taxii.rstcloud.net/ into this field.

4. Click on Add TAXII Feed.

5. The TAXII feed will now appear as an integration tile card on your My Integrations page using the display name you supplied.  You can also click on the Category dropdown and select STIX/TAXII to filter your view.  

6. Click on the TAXII feed's tile card to open up its details page.
7. Click on the Enable toggle switch, located above the Additional Information section, to enable the TAXII feed.

Change Log

• Version 1.0.0
  • Initial release