Flashpoint Ignite Threat Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Flashpoint^® Ignite ingests Attributes, Events, Reports, and Vulnerabilities from Flashpoint Ignite and creates corresponding objects in ThreatConnect with select Flashpoint metadata.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with version 7.2.0 or newer installed

Flashpoint Ignite Dependencies

• Active Flashpoint Ignite Token
  Important

  This is a new token that needs to be populated from the Flashpoint Ignite platform. The old FP.Tools token will not work with the Flashpoint Ignite Threat Intelligence Engine App.
• Subscription to the Cyber Threat Intelligence (CTI) product within the Flashpoint Ignite platform
  • To ingest premium Vulnerabilities, you must have the Vulnerability Intelligence Premium plan. See https://docs.flashpoint.io/flashpoint/docs/vulnerability-intelligence for more information (must have a valid Flashpoint account to view this documentation).

Application Setup and Configuration

Installing the App

Follow these steps to install the Flashpoint Ignite Threat Intelligence Engine App via TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the Flashpoint Ignite Threat Intelligence Engine App on the Catalog tab. Then click Installin the Options column to install the App.
4. After you install the Flashpoint Ignite Threat Intelligence Engine App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the App. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.

Updating the App [New]

If you previously installed the Flashpoint Ignite Threat Intelligence Engine App, follow these steps to update the App via TC Exchange:

1. Download the attributes.json file provided for the Flashpoint Ignite Threat Intelligence Engine App on ThreatConnect's Developer Hub.
2. Log into ThreatConnect with a System Administrator account.
3. Hover over Settingson the top navigation bar and select Account Settings. Then select the Communities/Sources tab.
4. Locate and click the name of the Source to which the current version of the Flashpoint Ignite Threat Intelligence Engine App is deployed to display the Source's Source Info screen.
5. Click the SOURCE CONFIG button on the left side of the screen to display the Source's Source Config screen.
6. Select the Attribute Types tab.
7. Click the UPLOAD button to display the Upload Attributes window.
8. Click + SELECT FILE, and then locate and select the attributes.json file you downloaded in Step 1.
9. Click SAVE.
10. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Updates tab on the TC Exchange Settings screen.
11. Locate the Flashpoint Ignite Threat Intelligence Engine App on the Updates tab. Then click Update Nowin the Options column to update the App.
12. On the top navigation bar, hover over Playbooks and select Services.
13. Restart the Flashpoint Ignite Threat Intelligence Engine App by toggling its slider off and then on again.

Configuration Parameters

Parameter Definitions [Updated]

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the Flashpoint Ignite Threat Intelligence Engine App.

Flashpoint Ignite Threat Intelligence Engine

After successfully configuring and activating the Feed API Service for the Flashpoint Ignite Threat Intelligence Engine App, you can access the Flashpoint Ignite Threat Intelligence Engine user interface (UI). This UI allows you to interact with and manage the Flashpoint Ignite integration.

Follow these steps to access the Flashpoint Ignite Threat Intelligence Engine UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services.
3. Locate the Flashpoint Ignite Threat Intelligence Engine Feed API Service on the Services screen, and then click the link in the Service’s API Path field to open the Dashboard screen of the Flashpoint Ignite Threat Intelligence Engine UI.

The following screens are available in the Flashpoint Ignite Threat Intelligence Engine UI:

• Dashboard
• Jobs
• Tasks
• Download
• Batch Errors
• Attachment Status

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of Flashpoint Attributes (Address, File, Host, Url); Events (Event, Malware, Intrusion Set); Reports (Report); and Vulnerabilities (Threat).

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of Flashpoint data into manageable Job-like tasks.

• Job ID: Enter text into this box to search for a specific Job by its ID.
• Job Type: Select a Job type by which to filter Jobs. Available types include ad-hoc and scheduled.
• Job Status: Select a Job status by which to filter Jobs. Available statuses include the following:
  • Convert Complete
  • Convert In Progress
  • Download Complete
  • Download In Progress
  • Failed
  • Upload Complete
  • Upload In Progress
• Add Job: Click this button to create an ad-hoc Job.

Add a Job

Follow these steps to create an ad-hoc Job on the Jobs screen of the Flashpoint Ignite Threat Intelligence Engine UI:

1. Navigate to the Jobs screen of the Flashpoint Ignite Threat Intelligence Engine UI (Figure 2). Then click Add Job at the top right of the screen.
2. Fill out the fields on the Add Job drawer (Figure 3) as follows:
   

    

   • Updated After: Select the date and time that Flashpoint data must be updated after in order to be ingested.
   • Updated Before: Select the date and time that Flashpoint data must be updated before in order to be ingested.
   • Flashpoint Types: Select the type(s) of Flashpoint objects to ingest. Available options include Event, FP Attribute, Report, and Vulnerability.
3. Click Submit on the Add Job drawer.

After the Job is created, it will be displayed in the table on the Jobs screen (Figure 2), and its Job type will be ad-hoc.

Tasks

The Tasks screen (Figure 4) is where you can view and manage the Tasks for each Job.

Download

The Download screen (Figure 5) is where you can download specific data from Flashpoint Ignite.

• External ID: Enter the Flashpoint ID (FPID) of the object to download.
• Type: Select the type of object to download. Available options include Event, Report, and Vulnerability.

After providing a FPID and selecting a Flashpoint object type, click Download to retrieve JSON responses and view the converted threat intelligence data in ThreatConnect batch format (Figure 6). To upload the threat intelligence data to the ThreatConnect Batch API, click Upload.

Batch Errors

The Batch Errors screen (Figure 7) displays batch errors for each request in a tabular format. Details provided for each error include the Job ID; date added; error code and message; and error reason.

Attachment Status

The Attachment Status screen (Figure 8) is where you can view attempts ThreatConnect made to download file attachments for Reports from Flashpoint Ignite. The table on this screen displays the most recent date and time when ThreatConnect attempted to download a file attachment, the number of times ThreatConnect attempted to download the file attachment, and whether ThreatConnect downloaded the file attachment successfully. You can also filter results by ID and download status on this screen, which can be useful if you do not see a file attachment for a Flashpoint Ignite Report in ThreatConnect as expected.

Data Mappings

The data mappings in Table 2 through Table 7 illustrate how data are mapped from Flashpoint Ignite API endpoints into the ThreatConnect data model.

Attribute (From Events Endpoint)

ThreatConnect object type: Indicator (Address, File, Host, or URL)

Value (From Events Endpoint)

ThreatConnect object type: Varies

Event

ThreatConnect object type: Event Group

Intelligence Report

ThreatConnect object type: Report Group

Vulnerability Intelligence (Essential) [Updated]

ThreatConnect object type: Threat Group

ThreatConnect object type: Vulnerability Group

Vulnerability Intelligence (Premium) [Updated]

ThreatConnect object type: Threat Group

ThreatConnect object type: Threat Group

Frequently Asked Questions (FAQ) [Updated]

What are the major changes to the Flashpoint Ignite Threat Intelligence Engine App in version 1.0.1?

The major changes to the Flashpoint Ignite Threat Intelligence Engine App in version 1.0.1 include the following:

• You can now set default values for Threat Rating, Confidence Rating, and Security Labels.
• Each Common Vulnerabilities and Exposures (CVE®) ID in Flashpoint is now mapped to a Vulnerability Group in ThreatConnect instead of being represented only as a Tag on a Threat Group.
• The technical_description Flashpoint Ignite API field now maps to the ThreatConnect "Analyst Notes" Attribute.

How are Flashpoint Vulnerability objects mapped to ThreatConnect objects?

Under Flashpoint Ignite’s Vulnerability structure, a single CVE ID can be associated with multiple Flashpoint IDs (FPIDs), or multiple CVE IDs can be associated with a single FPID. In version 1.0.0 of the Flashpoint Ignite Threat Intelligence Engine App, Flashpoint Vulnerabilities are mapped to Threat Groups in ThreatConnect. In version 1.0.1, each CVE ID representing a Flashpoint Vulnerability is mapped to a Vulnerability Group in ThreatConnect, and Common Weakness Enumeration (CWE™) IDs are mapped to Tags that are applied to Vulnerability and Threat Groups in ThreatConnect that correspond to Flashpoint Vulnerabilities.

How much historical Flashpoint data does the Flashpoint Ignite Threat Intelligence Engine App ingest into ThreatConnect?

During the initial ingestion of Flashpoint data, the Flashpoint Ignite Threat Intelligence Engine App will ingest Flashpoint objects added or published within the last 90 days. After the initial ingestion of data is complete, the App will ingest new data and update existing data every 2 hours.

Which Flashpoint data are modeled as Intrusion Sets in ThreatConnect?

The Flashpoint Ignite Threat Intelligence Engine App ingests and models the following Flashpoint data as Intrusion Set Groups in ThreatConnect:

• Actor descriptions from the Flashpoint Events API endpoint
• Actor Tags
• Actor Profile Tags applied to Flashpoint Reports

How can I ingest more historical data from Flashpoint?

Use the Add Job button on the Jobs screen of the Flashpoint Ignite Threat Intelligence Engine UI (Figure 2). When creating a Job, select an appropriate date range from which to ingest Flashpoint data. For Reports, FP Attributes, and Events, it is recommended to use an ingestion date range of 90 days or fewer. For Vulnerabilities, any ad-hoc Jobs with an ingestion date range greater than 2 days may interrupt the daily scheduled Job runs if the daily limit of 5000 calls per day to the Vulnerability Flashpoint API endpoints is reached.

How can I upgrade to the latest version of the Flashpoint Ignite Threat Intelligence Engine App?

Please refer to the instructions in the “Updating the App [New]” section.

The Service App for the Flashpoint Ignite Threat Intelligence Engine App is not starting, and I am getting an error saying, “Required attributes are missing. Shutting down Flashpoint Ignite app.” What should I do next?

Follow these instructions to address this issue:

1. Download the attributes.json file provided for the Flashpoint Ignite Threat Intelligence Engine App on ThreatConnect's Developer Hub.
2. Log into ThreatConnect with a System Administrator account.
3. Hover over Settingson the top navigation bar and select Account Settings. Then select the Communities/Sources tab.
4. Locate and click the name of the Source to which the current version of the Flashpoint Ignite Threat Intelligence Engine App is deployed to display the Source's Source Info screen.
5. Click the SOURCE CONFIG button on the left side of the screen to display the Source's Source Config screen.
6. Select the Attribute Types tab.
7. Click the UPLOAD button to display the Upload Attributes window.
8. Click + SELECT FILE, and then locate and select the attributes.json file you downloaded in Step 1.
9. Click SAVE.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
Flashpoint^® is a registered trademark of EJ2 Communications, Inc.
CVE^® (Common Vulnerabilities and Exposures), MITRE ATT&CK^®, and ATT&CK^® are registered trademarks, and CWE™ (Common Weakness Enumeration) is a trademark, of The MITRE Corporation.

30089-02 EN Rev. A