Flashpoint Ignite Threat Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Flashpoint^® Ignite ingests Attributes, Events, Reports, and Vulnerabilities from Flashpoint Ignite and creates corresponding objects in ThreatConnect with select Flashpoint metadata.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with version 7.2.0 or newer installed

Flashpoint Ignite Dependencies

• Active Flashpoint Ignite Token
  Important

  This is a new token that needs to be populated from the Flashpoint Ignite platform. The old FP.Tools token will not work with the Flashpoint Ignite Threat Intelligence Engine App.
• Subscription to the Cyber Threat Intelligence (CTI) product within the Flashpoint Ignite platform
  • To ingest premium Vulnerabilities, you must have the Vulnerability Intelligence Premium plan. See https://docs.flashpoint.io/flashpoint/docs/vulnerability-intelligence for more information (must have a valid Flashpoint account to view this documentation).

Application Setup and Configuration

Installing the App

Follow these steps to install the Flashpoint Ignite Threat Intelligence Engine App via TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the Flashpoint Ignite Threat Intelligence Engine App on the Catalog tab. Then click Installin the Options column to install the App.
4. After you install the Flashpoint Ignite Threat Intelligence Engine App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the App. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.

Updating the App

If you previously installed the Flashpoint Ignite Threat Intelligence Engine App, follow these steps to update the App via TC Exchange:

1. Download the attributes.json file provided for the Flashpoint Ignite Threat Intelligence Engine App on ThreatConnect's Developer Hub.
2. Log into ThreatConnect with a System Administrator account.
3. Hover over Settingson the top navigation bar and select Account Settings. Then select the Communities/Sources tab.
4. Locate and click the name of the Source to which the current version of the Flashpoint Ignite Threat Intelligence Engine App is deployed.
5. Click the SOURCE CONFIG button on the left side of the Source Info screen.
6. Select the Attribute Types tab on the Source Config screen.
7. Click the UPLOAD button.
8. Click + SELECT FILE on the Upload Attributes window, and then locate and select the attributes.json file you downloaded in Step 1.
9. Click SAVE.
10. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Updates tab on the TC Exchange Settings screen.
11. Locate the Flashpoint Ignite Threat Intelligence Engine App on the Updates tab. Then click Update Nowin the Options column to update the App.
12. Hover over Playbooks on the top navigation bar and select Services.
13. Restart the Flashpoint Ignite Threat Intelligence Engine App by toggling its slider off and then on again.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the Flashpoint Ignite Threat Intelligence Engine App.

Flashpoint Ignite Threat Intelligence Engine

After successfully configuring and activating the Feed API Service for the Flashpoint Ignite Threat Intelligence Engine App, you can access the Flashpoint Ignite Threat Intelligence Engine user interface (UI). This UI allows you to interact with and manage the Flashpoint Ignite integration.

Follow these steps to access the Flashpoint Ignite Threat Intelligence Engine UI:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over Playbooks on the top navigation bar and select Services.
3. Locate and turn on the Flashpoint Ignite Threat Intelligence Engine Feed API Service.
4. Click the link in the Service’s API Path field. The Flashpoint Ignite Threat Intelligence Engine UI will open in a new browser tab.

The following screens are available in the Flashpoint Ignite Threat Intelligence Engine UI:

• Dashboard
• Jobs
• Tasks
• Download
• Batch Errors
• Attachment Status

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of Attributes (Address, File, Host, Url), Events (Event, Malware, Intrusion Set), Reports (Report), and Vulnerabilities (Threat) retrieved from Flashpoint.

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of Flashpoint data into manageable Job-like tasks, displaying all processes that are pending, in progress, complete, and failed. The ⋯ menu in a Job’s row provides the following options:

• Details: View details for the Job, such as download, convert, and upload start and complete times and counts of downloaded and batched Groups and Indicators.
• Download Files: Download metadata files for all Jobs and data (convert, download, and upload) files for completed Jobs.
• Batch Errors: View errors that have occurred for the Job on the Batch Errors screen.

You can filter Flashpoint Ignite Threat Intelligence Engine App Jobs by the following elements:

• Job ID: Enter text into this box to search for a Job by its Job ID.
• Job Type: Select Job types to display on the Jobs screen.
• Status: Select Job statuses to display on the Jobs screen.

Add a Job

You can add ad-hoc Jobs on the Jobs screen. Follow these steps to create a request for an ad-hoc Job for the Flashpoint Ignite Threat Intelligence Engine App:

1. Click the Add Job button at the upper right of the Jobs screen (Figure 2).
2. Fill out the fields on the Add Job drawer (Figure 3) as follows:
   

    

   • Updated After: Select the date and time that Flashpoint data must be updated after in order to be ingested.
   • Updated Before: Select the date and time that Flashpoint data must be updated before in order to be ingested.
   • Flashpoint Types: Select the types of Flashpoint objects to include in the ad-hoc Job.
3. Click Submit to submit the request for the ad-hoc Job.

Tasks

The Tasks screen (Figure 4) displays all Tasks that may be part of a Job, including each step of the download, convert, and upload processes, as well as Tasks for the Flashpoint Ignite Threat Intelligence Engine App, such as Monitor, Scheduler, and Cleaner. The current status (Idle, Paused, or Running), name, description, and heartbeat timeout length, in minutes, are displayed for each Task. The ⋯ menu in a Task’s row provides the following options, depending on the Task’s status:

• Run (idle and paused Tasks only)
• Pause (idle and running Tasks only)
• Resume (paused Tasks only)
• Kill (running Tasks only)

Under the table is a dashboard where you can view runtime analytics.

Download

The Download screen (Figure 5) lets you download JavaScript® Object Notation (JSON) data for Flashpoint Ignite objects and then upload the data into ThreatConnect.

Follow these steps to download JSON data for a Flashpoint object on the Download screen and then upload the data into ThreatConnect:

1. External ID: Enter the Flashpoint ID (FPID) of the object to download.
2. Type: Select the type of object to download.
3. Click Download. The JSON data will be displayed in two columns: Results (raw JSON data) and Converted(JSON data in ThreatConnect batch format) (Figure 6).

   

    

4. Click Upload to submit the converted threat intelligence data via the ThreatConnect Batch API.

Batch Errors

The Batch Errors screen (Figure 7) displays a table with details on batch errors that have occurred for Job requests. You can filter the table by error type or enter keywords to filter by Job ID or reason for error.

Attachment Status

The Attachment Status screen (Figure 8) displays a table with details on ThreatConnect's attempts to download Report attachments from Flashpoint. You can enter keywords to filter the table by the Flashpoint Group ID, which can be useful if you do not see a Flashpoint attachment in ThreatConnect as expected, or by status.

Data Mappings

The data mappings in Table 2 through Table 7 illustrate how data are mapped from Flashpoint Ignite API endpoints into the ThreatConnect data model.

Attribute (From Events Endpoint)

ThreatConnect object type: Indicator (Address, File, Host, or URL)

Value (From Events Endpoint)

ThreatConnect object type: Varies

Event

ThreatConnect object type: Event Group

Intelligence Report

ThreatConnect object type: Report Group

Vulnerability Intelligence (Premium)

ThreatConnect object type: Threat Group

ThreatConnect object type: Threat Group

Frequently Asked Questions (FAQ)

What are the major changes to the Flashpoint Ignite Threat Intelligence Engine App in version 1.0.1?

The major changes to the Flashpoint Ignite Threat Intelligence Engine App in version 1.0.1 include the following:

• You can now set default values for Threat Rating, Confidence Rating, and Security Labels.
• Each Common Vulnerabilities and Exposures (CVE®) ID in Flashpoint is now mapped to a Vulnerability Group in ThreatConnect instead of being represented only as a Tag on a Threat Group.
• The technical_description Flashpoint Ignite API field now maps to the ThreatConnect "Analyst Notes" Attribute.

How are Flashpoint Vulnerability objects mapped to ThreatConnect objects?

Under Flashpoint Ignite’s Vulnerability structure, a single CVE ID can be associated with multiple Flashpoint IDs (FPIDs), or multiple CVE IDs can be associated with a single FPID. In version 1.0.0 of the Flashpoint Ignite Threat Intelligence Engine App, Flashpoint Vulnerabilities are mapped to Threat Groups in ThreatConnect. In version 1.0.1, each CVE ID representing a Flashpoint Vulnerability is mapped to a Vulnerability Group in ThreatConnect, and Common Weakness Enumeration (CWE™) IDs are mapped to Tags that are applied to Vulnerability and Threat Groups in ThreatConnect that correspond to Flashpoint Vulnerabilities.

How much historical Flashpoint data does the Flashpoint Ignite Threat Intelligence Engine App ingest into ThreatConnect?

During the initial ingestion of Flashpoint data, the Flashpoint Ignite Threat Intelligence Engine App will ingest Flashpoint objects added or published within the last 90 days. After the initial ingestion of data is complete, the App will ingest new data and update existing data every 2 hours.

Which Flashpoint data are modeled as Intrusion Sets in ThreatConnect?

The Flashpoint Ignite Threat Intelligence Engine App ingests and models the following Flashpoint data as Intrusion Set Groups in ThreatConnect:

• Actor descriptions from the Flashpoint Events API endpoint
• Actor Tags
• Actor Profile Tags applied to Flashpoint Reports

How can I ingest more historical data from Flashpoint?

Use the Add Job button on the Jobs screen of the Flashpoint Ignite Threat Intelligence Engine UI (Figure 2). When creating a Job, select an appropriate date range from which to ingest Flashpoint data. For Reports, FP Attributes, and Events, it is recommended to use an ingestion date range of 90 days or fewer. For Vulnerabilities, any ad-hoc Jobs with an ingestion date range greater than 2 days may interrupt the daily scheduled Job runs if the daily limit of 5000 calls per day to the Vulnerability Flashpoint API endpoints is reached.

How can I update to the latest version of the Flashpoint Ignite Threat Intelligence Engine App?

Please refer to the instructions in the “Updating the App” section.

The Service App for the Flashpoint Ignite Threat Intelligence Engine App is not starting, and I am getting an error saying, “Required attributes are missing. Shutting down Flashpoint Ignite app.” What should I do next?

Follow these instructions to address this issue:

1. Download the attributes.json file provided for the Flashpoint Ignite Threat Intelligence Engine App on ThreatConnect's Developer Hub.
2. Log into ThreatConnect with a System Administrator account.
3. Hover over Settingson the top navigation bar and select Account Settings. Then select the Communities/Sources tab.
4. Locate and click the name of the Source to which the current version of the Flashpoint Ignite Threat Intelligence Engine App is deployed to display the Source's Source Info screen.
5. Click the SOURCE CONFIG button on the left side of the screen to display the Source's Source Config screen.
6. Select the Attribute Types tab.
7. Click the UPLOAD button to display the Upload Attributes window.
8. Click + SELECT FILE, and then locate and select the attributes.json file you downloaded in Step 1.
9. Click SAVE.

Why do I not see any Vulnerability data from Flashpoint?

As of March 2025, Flashpoint does not support API access to Vulnerability data for Essential-tier membership. Vulnerability data are still available for users with the Vulnerability Intelligence Premium plan.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
Flashpoint^® is a registered trademark of EJ2 Communications, Inc.
JavaScript® is a registered trademark of Oracle Corporation.
CVE^® (Common Vulnerabilities and Exposures), MITRE ATT&CK^®, and ATT&CK^® are registered trademarks, and CWE™ (Common Weakness Enumeration) is a trademark, of The MITRE Corporation.

30089-03 EN Rev. A