The ThreatQ On-Prem Connector for Microsoft Exchange is a unidirectional integration that integrates directly with the Microsoft Exchange mail server. The connector enables the ingestion of emails and attachments into ThreatQ and supports parsing emails and attachments as well as forwarded emails (spearphishing).

The connector ingests the following system objects:

• Attachments
• Events
• Indicators

This connector requires TLS v1.3.

The required minimum versions of the software are:

• Windows Server 2022
• Microsoft Exchange 2019