---
title: "Dataminr CTTI Intelligence Engine User Guide"
slug: "dataminr-ctti-intelligence-engine-user-guide"
description: "Userguide to setup and configure Dataminr CTTI integration with Dataminr Agenetic Threat Intelligence Platform."
updated: 2026-09-30T12:41:55Z
published: 2026-09-30T12:41:55Z
canonical: "knowledge.threatconnect.com/dataminr-ctti-intelligence-engine-user-guide"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dataminr CTTI Intelligence Engine User Guide

## Overview

This article is a user guide for the **Dataminr CTTI Intelligence Engine** integration with Dataminr Agentic Threat Intelligence Platform (ATIP). The **Dataminr CTTI Intelligence Engine** [feed API service](https://knowledge.threatconnect.com/docs/feed-api-services) app ingests cyber threat intelligence alerts, and the cyber entities those alerts reference, from Dataminr Cyber Threat Intelligence (CTTI) and creates corresponding objects in Agentic TIP with select Dataminr metadata:

- **Alerts** are created as **Event Groups** in Agentic TIP.
- **Malware** entities are created as **Malware Groups** in Agentic TIP, associated back to the Event(s) or Malware Signatures that referenced them.
- **Malware Detection** entities are created as **Signature Groups** in Agentic TIP and associated with their parent Malware group and Event(s) that referenced them.
- **Threat Actor** entities are created as **Intrusion Set Groups** in Agentic TIP, associated back to the Event(s) that referenced them.
- **Vulnerability** entities are created as **Vulnerability Groups** in Agentic TIP, associated back to the Event(s) that referenced them.
- **IP Address, URL's, ASN and File Hash** entities are created as Indicator objects in Agentic TIP, associated back to the Event(s) and associated indicators that referenced them.

## Dependencies

### Agentic TIP Dependencies

- Active Agentic TIP API key
- Agentic TIP instance with **7.12.2** or newer installed

Note

All Agentic TIP dependencies will be provided by default to subscribing Agentic TIP Cloud customers. Customers on Dedicated Cloud and On-Premises instances can enable these settings on the **Account Settings** screen within their Agentic TIP instance.

### Dataminr CTTI Dependencies

- **API token (Bearer token)**
  - Issued from the Dataminr CTTI admin console
  - Requires an active Dataminr CTTI subscription with API access

## Application Setup and Configuration

The **Dataminr CTTI Intelligence Engine** app leverages the [Feed Deployer](https://knowledge.threatconnect.com/docs/the-feed-deployer) to create a [Source](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) for data ingestion from Dataminr CTTI in an Organization and to configure the corresponding service's ingestion and authentication parameters. After you install the **Dataminr CTTI Intelligence Engine** app on your Agentic TIP instance, you can deploy it to any Organization. It must be deployed separately for each Organization in which you want to create a Source for data ingestion and a corresponding service.

### Install the Dataminr CTTI Intelligence Engine App

Follow these steps to install the **Dataminr CTTI Intelligence Engine** app on your Agentic TIP instance:

1. Log into Agentic TIP with a System Administrator account.
2. From the **Organization Settings** menu on the top navigation bar, select **TC Exchange Settings**.
3. Select the **Catalog** tab on the **TC Exchange Settings** screen.
4. Locate the **Dataminr CTTI Intelligence Engine** app on the **Catalog** tab.
5. Click **Install** in the **Options** column for the app.
6. Click **INSTALL** in the app's **Release Notes** window.
7. After installation, the [Feed Deployer](https://knowledge.threatconnect.com/docs/the-feed-deployer) opens automatically. Follow the procedure in [Deploy the App to an Organization](/docs/dataminr-ctti-intelligence-engine-user-guide#deploy-the-dataminr-ctti-intelligence-engine-app-to-an-organization).

### Deploy the Dataminr CTTI Intelligence Engine App to an Organization

Follow these steps to deploy the **Dataminr CTTI Intelligence Engine** app to an Organization:

Note

Skip to step 4 if you just installed the app and are already viewing the **Feed Deployer** window.

1. Log into Agentic TIP with a System Administrator account.
2. From the **Settings** menu on the top navigation bar, select **TC Exchange Settings**.
3. Locate the **Dataminr CTTI Intelligence Engine** app on the **Installed** tab. Then select **Deploy** from the **Options** dropdown.
4. Fill out the fields in the **Feed Deployer** window as described below.

#### Feed Deployer Configuration

| Name | Description | Required? |
| --- | --- | --- |
| **Source Tab** |  |  |
| Sources to Create | Enter the name of the Source for the feed. Must be unique unless redeploying. Recommended: append the Organization's name (e.g., **Dataminr CTTI Intelligence Engine - Demo Organization**). | Required |
| Owner | Select the Organization in which the Source will be created. | Required |
| Activate Deprecation | Enable [Indicator Confidence Deprecation](https://knowledge.threatconnect.com/docs/indicator-confidence-deprecation) | Optional |
| Create Attributes | Allow [custom attribute types](https://knowledge.threatconnect.com/docs/creating-custom-attribute-types) to be created at the System level. **Recommended: keep this selected.** If deselected, data mapped to those attribute types will not be ingested. | Optional |
| **Parameters Tab** |  |  |
| Launch Server | Select **tc-job** as the launch server for the feed API service. | Required |
| Dataminr CTTI API URL | Base URL for your Dataminr CTTI tenant (e.g. `https://<your-tenant>.dmcd.<geo>.dataminr.com/api`). | Required |
| **Variables Tab** |  |  |
| Dataminr CTTI API Key | Bearer token API key from the Dataminr CTTI admin console. Stored as an encrypted credential. | Required |
| *(everything else)* | Every other setting — Saved Searches, Entity Enrichment, and Notifications — is configured after deployment. See [Inputs](/v1/docs/dataminr-ctti-intelligence-engine-user-guide#inputs). |  |
| **Confirm Tab** |  |  |
| Run Feeds after deployment | Run the service immediately after clicking **DEPLOY**. | Optional |
| Confirm Deployment Over Existing Source | Shown if the Source name is already in use. Select to confirm redeployment. **Warning:** Existing data may be overwritten. A new Service will be created; delete the previous one afterward. | Optional |

1. Click **DEPLOY** on the **Confirm** tab to deploy the app, creating a Source and corresponding feed API service in the Organization.

## Inputs

After the **Dataminr CTTI Intelligence Engine** app is deployed, most of its configuration is completed and later adjusted from inside the service's own UI rather than by redeploying.

### First-Time Setup

The first time you open the service's UI after deployment, a setup stepper walks you through **Ingestion**, **Notifications**, and **Advanced Settings** below, one group at a time.

Connection Stepper

This is a one-time flow used to validate connection details before moving on to the next configuration screens. There is no way to skip it or access the rest of the UI until it is complete. Every step must pass validation before you can continue to the next. Until then, no ingestion job is queued.

If you need to reconfigure, see [Troubleshooting & FAQ](/v1/docs/dataminr-ctti-intelligence-engine-user-guide#troubleshooting-faq).

The setup stepper can be accessed via Services> API Path. ![Dataminr CTTI v1.0 - setup screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Dataminr%20CTTI%20v1.0%20-%20setup%20screen.png)

### Connection Details

Dataminr CTTI's connection fields (**Tenant URL**, **API Key** — see [Feed Deployer Configuration](/docs/dataminr-ctti-intelligence-engine-user-guide#feed-deployer-configuration)) are shown read-only on the **Settings** page for confirmation. To change them, redeploy the app with new values.

There are 3 steps to configure in the setup stepper: ingestion, notification, and advanced settings.

### Ingestion

What this engine pulls from Dataminr CTTI, and how it is filtered. ![Dataminr CTTI v1.0 - ingestion](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Dataminr%20CTTI%20v1.0%20-%20ingestion.png)

| Field | Summary | Detail | Default |
| --- | --- | --- | --- |
| Saved Searches | Restrict ingestion to alerts matching these Dataminr saved searches. | Leave every option unselected to ingest all alerts this tenant can see. The list is read from the Dataminr CTTI console when the app starts. An entry marked as not found no longer exists in Dataminr — it is kept selected so an unrelated save does not silently drop it, but it matches nothing until it is removed or recreated. | None selected — every alert visible to the API key is ingested. |
| Entity Enrichment | Which entity types to resolve into full Agentic TIP objects. | Alerts arrive referencing entities by id. Enrichment is the extra API bulk call that turns those references into real objects, associated to the alert; without it the alert still ingests, but that entity type's context does not come with it. Select fewer types to reduce API calls against your rate limit and speed up jobs; leave none selected to skip enrichment entirely. | IP Address, URL, Threat Actor, Vulnerability, Malware, ASN, and File Hash — all selected. |

### Notifications

Operational alerts about this engine are delivered to the Agentic TIP notification center. Everything is recorded on the Notifications page in this app either way.

| Field | Summary | Detail | Default |
| --- | --- | --- | --- |
| Notification Digest Interval | How often queued notifications are batched and sent. | Events are collected and delivered to the Agentic TIP notification center as a single digest on this interval, rather than as one message per event, so a burst of retries does not flood it. Recipients are the Agentic TIP users and groups configured on the job itself. A shorter interval means you hear about a problem sooner but receive more messages; a longer one batches a whole incident into one. Nothing is lost either way — every event is recorded on the Notifications page in this app regardless of when, or whether, a digest is sent. | 2 Hours |
| Notification Types | Which events are delivered to the notification center. | Selected event types are sent to the Agentic TIP notification center on the digest interval above. Unselected types are still recorded in full on the Notifications page in this app — they are simply not delivered, so deselecting one hides it from your inbox, not from the record. Options: App Startup, Job Retrying, Job Failed, Job Recovered. | App Startup, Job Retrying, Job Failed, and Job Recovered — all selected. |

### Advanced Settings

Users will need to validate their configuration before clicking 'Finish setup'.

## Data Mappings

The data mappings below illustrate how data are mapped from Dataminr CTTI API endpoints to the [Agentic TIP data model](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model).

### Alerts

**Agentic TIP object type:** Event Group

Alerts are ingested from `GET /alerts/stream` during scheduled polling, or fetched individually by ID via `POST /alerts/search` from the Download screen.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `coreAlert.headline` | name |
| `alertId` | xid |
| `alertTimestamp` | event_date, external_date_added |
| `alertId` | Attribute: "External ID" |
| `appLinks.detail` | Attribute: "Source" |
| `coreAlert.source.expandedHref` | Attribute: "Data Source URL" |
| `coreAlert.source.href` (Intel Agents analysis) | Attribute: "Additional Analysis and Context" |
| `coreAlert.source.href` (predictive intelligence report) | Attribute: "Predictive Intel - Report" |
| `coreAlert.source.href` (predictive intelligence mitigation summary) | Attribute: "Predictive Intel - Summary" |
| `coreAlert.parentAlertId` | Attribute: "Parent Alert ID" |
| `coreAlert.severity.label` | Attribute: "Priority" |
| `classification.topics[*].name` | Attribute: "Alert Topic" |
| `classification.companies[*].name` | Attribute: "Company" |
| `coreAlert.source.channels[*]` | Attribute: "Source Channel" |
| `coreAlert.location.name` | Attribute: "Location Name" |
| `coreAlert.location.coordinates.lat` | Attribute: "Latitude" |
| `coreAlert.location.coordinates.lng` | Attribute: "Longitude" |
| `coreAlert.location.probabilityRadius` | Attribute: "Probability Radius" |
| `matchedSavedSearches[*].name` | Attribute: "Alert Rule" |
| (predictive intelligence report and summary, plus Intel Agents analysis) | Attribute: "Description" (pinned) |
| `classification.topics[*].name` | Tags |
| `coreAlert.source.name` | Tag: "Source: {name}" |

> **Note:** The **Additional Analysis and Context**, **Predictive Intel - Report**, **Predictive Intel - Summary**, and pinned **Description** attributes carry AI-generated analysis produced by Dataminr, not raw vendor fields.

### Malware

**Agentic TIP object type:** Malware Group

Malware entities are fetched via `POST /entity/bulk` (type `malware`), when **Entity Enrichment** includes Malware, for entities referenced by ingested alerts.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `payload.name` | name |
| `entity` | xid |
| `entity` | Attribute: "External ID" |
| `payload.attackVector` | Attribute: "Targeted Platforms" |
| (description and YARA rules) | Attribute: "Description" (pinned) |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### Malware Detections

Each Dataminr YARA signature is created as a separate Agentic TIP **Signature Group** and associated with the Dataminr Alert and Malware Group that supplied it. The signature data is sourced from `payload.yaraRules`; `payload.yara` is supported as a fallback when `payload.yaraRules` is absent.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| YARA signature name from `payload.yaraRules[*]` (or `payload.yara[*]`) | name |
| YARA rule body from `payload.yaraRules[*]` (or `payload.yara[*]`) | Attribute: "Description" (pinned) |
| `payload.affectedOperatingSystems[*]` | Attribute: "Operating System" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Parent malware entity | Associated Malware Group |
| Referencing alert(s) | Associated Event Group |

Yara Rules

The payload.yaraRules field is URL-encoded and may contain large rule bodies. Only the first five rules are included in the generated output.

### Threat Actors

**Agentic TIP object type:** Intrusion Set Group

Threat actor entities are fetched via `POST /entity/bulk` (type `threatActor`), when **Entity Enrichment** includes Threat Actor, for entities referenced by ingested alerts.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `payload.name` | name |
| `entity` | xid |
| `entity` | Attribute: "External ID" |
| `payload.aliases[*]` | Attribute: "Aliases" |
| (description and MITRE ATT&CK TTPs) | Attribute: "Description" (pinned) |
| `payload.ttps[*].techniqueId` | Tags (MITRE ATT&CK technique) |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### Vulnerabilities

**Agentic TIP object type:** Vulnerability Group

Vulnerability entities are fetched via `POST /entity/bulk` (type `vulnerability`), when **Entity Enrichment** includes Vulnerability, for entities referenced by ingested alerts.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `entity` (CVE identifier) | name, xid |
| `payload.publishedDate` | external_date_added |
| `entity` | Attribute: "External ID" |
| (description, risk metrics, affected products, weaknesses, and PoC links) | Attribute: "Description" (pinned) |
| `payload.cvss` | Attribute: "CVSS Base Score" |
| `payload.epssScore` | Attribute: "EPSS Score" |
| `payload.exploitable` | Attribute: "Has Exploit" |
| `payload.knownExploitedDate` | Attribute: "Known Exploited Date" |
| `payload.exploitPocLinks[*]` | Attribute: "Exploit PoC Link" |
| `payload.cpes[*]` | Attribute: "CPE" |
| `payload.products[*].productName` | Attribute: "Vulnerable Product" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### IP Addresses

**Agentic TIP object type:** Address Indicator

IP address entities are fetched via `POST /entity/bulk` (type `ipAddress`), when **Entity Enrichment** includes IP Address, for entities referenced by ingested alerts.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `entity` | summary (indicator value) |
| `entity` | Attribute: "External ID" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### URLs

**Agentic TIP object type:** URL Indicator

URL entities are fetched via `POST /entity/bulk` (type `url`), when **Entity Enrichment** includes URL, for entities referenced by ingested alerts.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `entity` | summary (indicator value) |
| `entity` | Attribute: "External ID" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### Autonomous System Numbers (ASNs)

**Agentic TIP object type:** ASN Indicator

ASN entities are ingested as indicators when Dataminr CTTI alerts reference them.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `entity` (ASN value) | summary (indicator value) |
| `entity` | Attribute: "External ID" |
| `asnOrganization` | Attribute: "Organization" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

### File Hashes

**Agentic TIP object type:** File Indicator

File hash entities are ingested as file indicators when Dataminr CTTI alerts reference them.

| Dataminr CTTI API Field | Agentic TIP Field |
| --- | --- |
| `entity` (file hash) | summary (indicator value) |
| `entity` | Attribute: "External ID" |
| `hashType` | Attribute: "Hash Type" |
| *(static)* | Attribute: "Source" = "Dataminr CTTI" |
| Referencing alert(s) | Associated Event Group |

## Workflow/Use Cases

The following workflows describe common ways to use the **Dataminr CTTI Intelligence Engine** integration.

### Automated Continuous Alert Ingestion

This is the primary, hands-off workflow once setup is complete:

1. Every few minutes, the engine automatically checks Dataminr CTTI for new and updated alerts — no manual action is required.
2. On its very first run, the engine anchors to the current time and ingests alerts published from that point forward.  It is possible to schedule a manual job should you wish to backfill alert data from a particular point in time.
3. If **Saved Searches** are configured, only alerts matching one of those searches are ingested; otherwise every alert visible to the API key is ingested.
4. For each alert, entities enabled under **Entity Enrichment** are resolved into full Agentic TIP Groups or Indicators and associated back to the alert's Event.
5. Resulting Groups and Indicators appear in the Source you configured at deployment. Job status and counts are visible on the **Jobs** screen in the service UI.

Alert Backfill

It is possible to schedule a manual job to backfill Dataminr CTTI alerts. To do this, go to Services, select the API path for your Dataminr CTTI app instance, then choose Add Jobs and schedule a job for the time window you need.

### On-Demand Alert Lookup

Use this workflow to pull a specific alert by ID — for example, to backfill an alert that predates the engine's start time, or to verify how an alert converts before it arrives through the automated pipeline:

1. Open the service UI and select **Download** from the navigation.
2. Enter the Dataminr CTTI **Alert ID**.
3. Submit the request. The raw Dataminr alert and its converted Agentic TIP representation are both displayed.
4. Confirm the upload to send the converted Groups and Indicators to Agentic TIP immediately.

## Troubleshooting & FAQ

This section covers common failure scenarios and their resolutions, followed by frequently asked questions.

### Service Fails to Start

**Symptom:** The service does not start after deployment, or immediately shows an error state.

**Cause:** The Dataminr CTTI API URL or API Key entered at deployment is incorrect, or the tenant is unreachable from the Agentic TIP server.

**Resolution:** Confirm the tenant URL and API key are correct and that the key has not been revoked, then redeploy the app with corrected values via the Feed Deployer.

### A Settings Change or First-Time Setup Step Won't Save

**Symptom:** Saving a settings change, or advancing past a step in the first-time setup stepper, fails validation.

**Cause:** One of the following checks did not pass:

- The engine could not reach the Dataminr CTTI API — the tenant URL or API key is wrong, the key has been revoked, or the Agentic TIP server cannot reach the tenant.
- One or more configured **Saved Searches** entries could not be matched against the tenant's saved searches in Dataminr — names are matched case-insensitively, and UUIDs are also accepted.

**Resolution:** Resolve the specific check reported in the validation message: correct the connection details, or fix or remove the unresolved saved search entries.

### Cannot Get Past the First-Time Setup Stepper

**Symptom:** The service UI opens on the setup stepper and there is no way to reach the rest of the UI.

**Cause:** This is intended behavior — first-time setup is a hard gate with no skip option, and no ingestion job is queued until it is completed.

**Resolution:** Complete each step; it must pass validation before the next becomes available (see the previous entry for common causes). If setup was already completed and needs to be redone — for example, it was completed with incorrect values, an administrator can reset it by sending a `DELETE` request to `/api/onboarding` on the service's API path. This does not delete your current settings; it only clears the "setup completed" record, so the stepper reopens pre-populated with the existing configuration.

### Batch Errors During Upload

**Symptom:** Jobs complete, but the **Batch Errors** screen in the service UI shows errors for some objects.

**Cause:** Typically a Agentic TIP batch validation failure — most commonly a missing custom attribute type, which happens when **Create Attributes** was not selected at deployment.

**Resolution:** Review the error details on the **Batch Errors** screen. If the cause is a missing attribute type, redeploy the app with **Create Attributes** selected.

### Alerts Are Ingesting, but Nothing Appears in Agentic TIP

**Symptom:** Jobs on the **Jobs** screen complete successfully, but no new Event Groups appear in the Source.

**Cause:** Because **Saved Searches** filtering happens on Dataminr's side, an overly narrow set of saved searches looks identical to "no alerts available" — jobs succeed with zero results.

**Resolution:** Check the alert count in the job's details on the **Jobs** screen. If it is zero, temporarily clear **Saved Searches** to confirm alerts are flowing at all, then narrow the filter back down once confirmed.

### Event Groups Are Created, but No Associated Entities Appear

**Symptom:** Alerts ingest as Event Groups, but no Malware, Threat Actor, Vulnerability, Address, or URL objects appear.

**Cause:** The entity types those alerts reference are not selected under **Entity Enrichment**, or the alerts genuinely reference no cyber entities.

**Resolution:** Confirm the relevant entity types are selected under **Entity Enrichment** on the Settings page.

**What subscription or licensing is required to use this integration?**

An active Dataminr CTTI subscription with API access is required, along with a valid Bearer token API key issued from the Dataminr CTTI admin console.

**How often does the integration pull new data?**

Every 5 minutes. Alerts appear in Agentic TIP based on when Dataminr publishes or updates them.

**How much data can this integration hold?**

The Source created at deployment is configured to support up to 10,000,000 indicators and 10 GB of associated document storage.

**What happens to existing data when I redeploy?**

Redeploying over an existing Source name creates a new service; existing data in Agentic TIP is not deleted. Delete the previous service afterward to avoid running duplicate services against the same Source.

**Can I run multiple instances for different Organizations?**

Yes. Deploy the app separately, via the Feed Deployer, for each Organization that needs its own Source and service.

**Where can I find logs for this service?**

Failure notifications from this service include log files by default. For the service's own logs directly, go to the Agentic TIP **Services** screen, select this service's row, and open its **Details** drawer, which offers a log download option.

## Technical Reference

This section is a brief technical pointer for readers who want to know where the data comes from. It intentionally stays high-level.

**Vendor API base URL:** `https://api.your-tenant.dataminr.com/public/v1`

| Endpoint | Used for |
| --- | --- |
| `GET /alerts/stream` | Cursor-based polling for new and updated alerts during scheduled ingestion. |
| `POST /alerts/search` | Looking up a specific alert by ID from the Download screen. |
| `POST /entity/bulk` | Resolving cyber entities (vulnerability, ipAddress, malware, threatActor, url, hashValue) referenced by alerts into full records. |
| `GET /searches` | Loading the tenant's saved searches, for the Saved Searches setting and its validation. |
| `GET /alerts/filters` | Verifying connectivity to the tenant during connection validation. |

---

ThreatConnect® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc. Feedly™ is a trademark of Feedly, Inc. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.

30091-02 EN Rev. A |