The IronNet custom connector ingests alerts and IoCs from an IronNet IronDefense appliance into ThreatQ as events. The user can also change the status of the events in ThreatQ, the change will be synced back to the IronNet appliance. The connector pulls alerts based on a date and severity score range.