The Bolster AI Action Bundle enables ThreatQ users to enrich FQDN and URL type indicators with threat intelligence from the Bolster AI platform. By querying the Bolster AI DomainTest and Scan APIs, the bundle retrieves domain dispositions and scan results, adding valuable context to indicators to support investigation and threat analysis within ThreatQ.

The integration provides the following actions:

• Bolster AI - DomainTest - submits an FQDN or URL indicator to Bolster AI and adds the returned disposition to the indicator.
• Bolster AI - Scan Results - maps completed Scan API-style results for an FQDN or URL indicator and adds richer scan context.

The integration is compatible with the following indicator types:

• FQDN
• URL

The integration returns enriched indicators and indicator attributes.

Note: This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.