ThreatQ Supported
abuse.ch MalwareBazaar Action
The abuse.ch Malwarebazaar action submits data collection containing MD5, SHA-1 and SHA-256 IOCs to abuse.ch MalwareBazaar and returns Indicators, TTPs and Malware. The abuse.ch MalwareBazaar queries the submitted objects for enrichment and returns related threat intelligence to be ingested into the ThreatQ library.
Version
1.1.0Categories
Commercial Intelligence,Orchestration
abuse.ch ThreatFox Action
The abuse.ch ThreatFox Action submits a collection of indicators to the abuse.ch ThreatFox API in the form of individual HTTP requests. The returning response will provide additional contextual information for every indicator submitted.
Version
1.0.2Categories
Commercial Intelligence
AlienVault OTX Pulse CDF
AlienVault Open Threat Exchange is a Threat Intelligence sharing community provided at no cost to users, who are encouraged (but not required to share) intel information with other members. Users can subscribe to certain members to consume the intel that they publish.
Version
1.2.0Categories
Open Source Intelligence
ANY.RUN CDF
The ANY.RUN CDF for ThreatQ enables a ThreatQ user to automatically ingest malware samples, malware analysis reports, and related IOCs from samples that your organization submitted to ANY.RUN. The integration then parses the data and ingests it into ThreatQ.
