The Augur Security Action enriches supported ThreatQ indicators with threat intelligence from the Augur Security platform. Based on user-selected options, the action can ingest contextual information such as related indicators, breach intelligence, WHOIS data, MITRE ATT&CK mappings, and other threat context, providing analysts with additional intelligence to support investigation and response workflows.

The integration provides the following action:

• Augur Security - Enrich IOCs - queries Augur Security for each supported indicator contained in the submitted ThreatQ data collection and enriches the corresponding source indicators with configurable attributes, tags, description content, and related threat intelligence objects.

The integration is compatible with the following indicator types:

• IP Address
• MD5
• SHA-1
• SHA-256
• FQDN
• CIDR Block

The integration enriches the following object types:

• Adversaries
• Attack Patterns
• Indicators
  • ASN
  • CVE
  • Filename
  • FQDN
  • IP Address
  • MD5
  • SHA-1
  • SHA-256
  • SHA-512
  • URL
• Malware
• Reports
• Tools
• Vulnerabilities

Note: This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.