Accenture iDefense Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Accenture™ iDefense^® ingests data from the Accenture iDefense intel collection into ThreatConnect for analysis and response actions. The integration downloads intel Indicators (Domain, File, IPv4, IPv6, and URL), Campaigns, Malware, Reports, Signatures (YARA), Threat Actors, Tools, and Vulnerabilities.

Accenture iDefense delivers data in the STIX™ 2.1 format via a TAXII™ 2.1 server.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with version 7.0 or newer installed

Accenture iDefense Dependencies

• Active subscription to Accenture iDefense with username and password credentials

Application Setup and Configuration

Installing the App

1. Log into ThreatConnect with a System Administrator account.
2. Install the Accenture iDefense Intelligence Engine App via TC Exchange™.
3. Use the ThreatConnect Feed Deployer to set up and configure the Accenture iDefense Intelligence Engine App.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the App.

Accenture iDefense Intelligence Engine

After successfully configuring and activating the Feed API Service, you can access the Accenture iDefense Intelligence Engine user interface (UI). This UI allows you to interact with and manage the Accenture iDefense integration.

Follow these steps to access the UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services. The Services tab of the Playbooks screen will be displayed. 
3. Locate the Accenture iDefense Intelligence Engine Feed API Service and then click the link in the Service’s API Path field. The DASHBOARD screen of the Accenture iDefense Intelligence Engine UI will open in a new browser tab.

The following screens are available in the Accenture iDefense Intelligence Engine UI:

• DASHBOARD
• JOBS
• TASKS
• DOWNLOAD
• REPORT

DASHBOARD

The DASHBOARD screen (Figure 1) provides an overview of the total number of Indicators (Domain, File, IPv4, IPv6, and URL), Campaigns, Malware, Reports, Signatures (YARA), Threat Actors, Tools, and Vulnerabilities retrieved from Accenture iDefense. Depending on the data available to you, cards representing all or a subset of these object types will be displayed on the DASHBOARD screen.

JOBS

The JOBS screen (Figure 2) breaks down the ingestion of Accenture iDefense data into manageable Job-like tasks.

• Job Type: If desired, select a Job type by which to filter Jobs. Available types include ad-hoc and scheduled. 
• Status:If desired, select a Job status by which to filter Jobs. Available statuses include the following:
  1. Download In Progress
  2. Download Complete
  3. Convert In Progress
  4. Convert Complete
  5. Upload In Progress
  6. Upload Complete
• Request ID: If desired, enter text into this box to search for a specific Job by its request ID.
• + Add Request: Click this button to display the ADD REQUEST window (Figure 4). On this window, you can specify the date range and object types for an ad-hoc Job request. After a Job request is added, it will be displayed in the table on the JOBS screen (Figure 2), and its Job type will be listed as ad-hoc.
  

   

TASKS

The TASKS screen (Figure 4) is where you can view and manage the Tasks for each Job.

DOWNLOADS

The DOWNLOADS screen (Figure 5) is where you can download data exactly as they appear in Accenture iDefense.

• ID(s): Enter the Accenture iDefense ID(s) for the object(s) to download. Data will be retrieved in JavaScript^® Object Notation (JSON) format.
• Convert: Select this checkbox to convert the threat intelligence data to ThreatConnect batch format.
• Enrich: Select this checkbox to submit the threat intelligence data to the ThreatConnect Batch API.

REPORTS

The REPORTS screen provides a BATCH ERRORS view (Figure 6) that displays batch errors for each request in a tabular format. Details provided for each error include the error’s code, message, and reason.

Data Mappings

The data mappings in Table 2 through Table 13 illustrate how data are mapped from Accenture iDefense API endpoints into the ThreatConnect data model.

IPv4

ThreatConnect object type: Address Indicator

IPv6

ThreatConnect object type: Address Indicator

URL

ThreatConnect object type: URL Indicator

Domain

ThreatConnect object type: Host Indicator

File

ThreatConnect object type: File Indicator

Threat Actor

ThreatConnect object type: Adversary Group

Malware

ThreatConnect object type: Malware Group

Report

ThreatConnect object type: Report Group

Tool

ThreatConnect object type: Tool Group

Campaign

ThreatConnect object type: Campaign Group

Vulnerability

ThreatConnect object type: Vulnerability Group

Signature (YARA)

ThreatConnect object type: Signature Group

Frequently Asked Questions (FAQ)

How does the Accenture iDefense Intelligence Engine App differ from the Accenture iDefense IntelGraph Intelligence Engine App?

Accenture changed its intel delivery from IntelGraph to a TAXII 2.1 server solution. This means the integration data are formatted with the STIX 2.1 standard format.

Between the two Apps, users can expect differences in the data ingested by each one. These data differences, which are due to limitations of the STIX 2.1 data format, mean that there are fewer intel data points in Accenture's new implementation for intel delivery.

Accenture will end support of its iDefense IntelGraph solution on October 16, 2023. After the end-of-support date, the Accenture iDefense IntelGraph Intelligence Engine App will not be able to collect data from Accenture iDefense.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
Accenture™ is a trademark of Accenture Global Services Limited.
iDefense^® is a registered trademark of Accenture.
JavaScript^® is a registered trademark of Oracle Corporation.
STIX™ and TAXII™ is a trademark of The MITRE Corporation.

30081-02 EN Rev. A