Content Packs Overview

Updated on 17 Nov 2023
1 Minute to read

Print
Dark

Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Overview

A Content Pack is a bundle of Applications, Artifact types, Attribute Types, Playbooks, and/or Workflows that provides you with all of the tools you need to enable a particular use case in ThreatConnect^®. Content Packs save you from the work of having to create and put all of the building blocks of your use case together yourself. They are a ready-made, out-of-the-box solution that enables you to start triaging, analyzing, and acting right away.

ThreatConnect has a growing library of Content Packs available in TC Exchange™. System Administrators can import Content Packs from TC Exchange and then install them on their ThreatConnect instance. You can also create your own Content Packs using an internal API endpoint and have your System Administrator install them on your ThreatConnect instance using the corresponding .tcxp file. If your System Administrator has access to ThreatConnect Cloud, they can also publish Content Packs to the TC Exchange catalog for easy distribution to the broader ThreatConnect customer base.

Before You Start

Minimum Role(s)	Organization role of Organization Administrator (for generating a bearer token to use when creating Content Packs via the internal Content Pack API endpoint) System role of Administrator (for installing Content Packs) System role of Administrator on ThreatConnect Cloud (for publishing Content Packs to the TC Exchange catalog)
Prerequisites	Before creating a Content Pack, ensure that the following prerequisites are met on your ThreatConnect instance: The Apps you want to add to the Content Pack are installed via TC Exchange The Artifact types and Attribute Types you want to add to the Content Pack are created at the System level The Playbooks and Workflows you want to add to the Content Pack are created in your Organization To install and publish a Content Pack, you must have access to the corresponding .tcxp file.

Minimum Role(s)

Organization role of Organization Administrator (for generating a bearer token to use when creating Content Packs via the internal Content Pack API endpoint)
System role of Administrator (for installing Content Packs)
System role of Administrator on ThreatConnect Cloud (for publishing Content Packs to the TC Exchange catalog)

Prerequisites

Before creating a Content Pack, ensure that the following prerequisites are met on your ThreatConnect instance:

The Apps you want to add to the Content Pack are installed via TC Exchange
The Artifact types and Attribute Types you want to add to the Content Pack are created at the System level
The Playbooks and Workflows you want to add to the Content Pack are created in your Organization

To install and publish a Content Pack, you must have access to the corresponding .tcxp file.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.

20152-01 v.02.A

Was this article helpful?

What's Next

Creating Content Packs

Table of contents

Overview
Before You Start