ThreatQ Supported
GreyNoise Community Action
The GreyNoise Community Action submits a collection of IP Addresses to the GreyNoise Community API in individual HTTP Requests. GreyNoise returns a response for each object containing any information they have about the indicator. A sample response can be found within this file.
Version
1.0.3Categories
Orchestration
abuse.ch MalwareBazaar Action
The abuse.ch Malwarebazaar action submits data collection containing MD5, SHA-1 and SHA-256 IOCs to abuse.ch MalwareBazaar and returns Indicators, TTPs and Malware. The abuse.ch MalwareBazaar queries the submitted objects for enrichment and returns related threat intelligence to be ingested into the ThreatQ library.
Version
1.1.0Categories
Commercial Intelligence,Orchestration
CrowdStrike Insight EDR Action Bundle
The CrowdStrike Insight EDR Bundle provides action that submit data collections containing IP Address, SHA-1, SHA-256 and MD5 IOCs to CrowdStrike Insight EDR. The integration queries the submitted objects for enrichment and returns related threat intelligence to be ingested into the ThreatQ library.
Version
1.1.0Categories
Orchestration
Tenable Vulnerability Management Action Bundle
The actions included with the Tenable.io Action Bundle integrate with the Tenable.io API and provide visibility into the assets and vulnerabilities for an organization. The actions can run scans to identify vulnerabilities and submit data from a collection to retrieve vulnerability data for ingestion into the ThreatQ library.
Version
1.2.0Categories
Orchestration
VMware Carbon Black EDR Action Bundle
VMware Carbon Black EDR is an incident response and threat hunting solution designed for Security Operations Center teams with offline environment requirements. VMware Carbon Black EDR continuously records and stores endpoint activity data so security professionals can hunt threats in real time and visualize the complete attack kill chain, using the VMware Carbon Black Cloud’s aggregated threat intelligence.