The Enrichment Tab

Overview

Enriching threat intelligence data helps remove false positives and delivers actionable intelligence for threat investigations and other security operations. ThreatConnect^® includes built-in enrichment services that retrieve data from a third-party enrichment service that a System Administrator has enabled on your instance and for a given Indicator type and then display that data on the Enrichment tab of the Indicator’s Details screen.

The Enrichment tab displays a card for each enrichment service enabled for the Indicator’s type that includes a summary of data retrieved from the enrichment service. Each enrichment service card also provides the ability to display a detailed view of enrichment information for the Indicator and retrieve the most up-to-date information from the enrichment service for the Indicator manually.

At this time, VirusTotal™ is the only third-party enrichment service available in ThreatConnect, and it can be enabled for Address, File, Host, and URL Indicators only.

Before You Start

The Enrichment Tab

If an enrichment service is available for a given Indicator type, the Enrichment tab of the Details screen will be available for Indicators of that type, regardless of whether a System Administrator enabled the enrichment service.

Figure 1 shows the Enrichment tab of the Details screen for the badguy.com Host Indicator, where a VirusTotal card is displayed because the VirusTotal enrichment service is available for Host Indicators. In this example, the VirusTotal enrichment service is also enabled on the ThreatConnect instance and for Host Indicators, so the VirusTotal card displays data retrieved from VirusTotal for the badguy.com Host Indicator.

To collapse or expand all cards on the Enrichment tab, click the Collapse All or Expand All button, respectively. By default, all cards are expanded.

VirusTotal Enrichment

Data Overview

The Overview section of the VirusTotal card (Figure 1) provides a summary of data retrieved from VirusTotal for the Indicator and the date and time the data were last retrieved.

The information displayed in the Overview section of this card varies based on the Indicator’s type. See Table 1 for a list of data fields that may be displayed on the Overview section of the VirusTotal card and the Indicator type(s) to which each field applies.

VirusTotal Detailed View

Click the Open Detailed View link on the VirusTotal card to display the VirusTotal Detailed View drawer (Figure 2). This drawer displays cards with additional information retrieved from VirusTotal for the Indicator.

The cards displayed on an Indicator’s VirusTotal Detailed View drawer are collapsed by default and vary based on the Indicator’s type. Click on a card to expand it and view its data. Figure 3 shows the VirusTotal Detailed View drawer in Figure 2 with all available cards expanded.

See Table 2 for a list of cards that may be displayed on the VirusTotal Detailed View drawer based on an Indicator’s type.

Retrieving Data Manually

When you click on an Indicator’s Enrichment tab for the first time, data are retrieved from VirusTotal and then cached for a period of time that your System Administrator configured. Each time you revisit that Indicator’s Enrichment tab, the cached VirusTotal data will be displayed until this period of time has passed.

To retrieve the latest VirusTotal data for the Indicator manually, click the Retrieve Data button.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
VirusTotal™ is a trademark of Google, Inc.

20146-01 v.01.A