The Investigation Links Operation generates and saves direct links to supported external security products and threat intelligence platforms for the selected indicator. By providing one-click access to relevant third-party investigation tools, the operation enables analysts to quickly pivot between platforms, gather additional context, and accelerate threat analysis without manually constructing search URLs or performing separate lookups.

Note: Despite its similar name, the Investigation Links Operation is independent of the ThreatQ Investigations (TQI) module. This operation does not integrate with or provide functionality related to TQI; its sole purpose is to generate direct links to external investigation platforms for supported indicators.

The integration provides the following operation action:

• Generate Links - generates and saves direct links to supported external security products and threat intelligence services for the selected indicator.

The integration is compatible with the following indicator types:

• CVE
• Email Address
• FQDN
• IP Address
• IPv6 Address
• MD5
• SHA-1
• SHA-256
• SHA-512
• URL