The IPsum CDF integration enables ThreatQ to automatically ingest suspicious and malicious IP addresses from the IPsum threat intelligence repository, which aggregates data from more than 30 publicly available sources. The integration periodically imports IP addresses and their associated blacklist occurrence counts into ThreatQ as Indicators and Indicator Attributes, providing analysts with consolidated IP reputation intelligence.

The integration provides the following feed:

• IPsum - retrieves IPsum blacklist data from GitHub and ingests it into ThreatQ.

The integration ingests IP Address type indicators and indicator attributes.