Flashpoint Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Flashpoint^® ingests Reports, Events, Indicators, Vulnerability, and Malware data from Flashpoint into ThreatConnect. These Groups and Indicators are stored and associated in ThreatConnect with select relevant context.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with version 7.0 or newer installed

Flashpoint Dependencies

• Active Flashpoint Intelligence token

Application Setup and Configuration

Installing the App

1. Log into ThreatConnect with a System Administrator account.
2. Install the Flashpoint Intelligence Engine App via TC Exchange™.
3. Use the ThreatConnect Feed Deployer to set up and configure the Flashpoint Intelligence Engine App.

Configuring ATT&CK Tag Conversion Rules

After installing and configuring the Flashpoint Intelligence Engine App, add the ThreatConnect Source that will contain the ingested Flashpoint data to the Approximate Match ATT&CK^® Tag conversion rule on the Tags tab of the System Settings screen in ThreatConnect (Figure 1). For instructions on performing this process, see the "Adding an Owner to a Conversion Rule" section of ATT&CK Tags.

Completing this process will convert standard Tags applied to the ingested Flashpoint data that start with the letter “T” followed by a set of digits that map to a technique or sub-technique ID (e.g., T1055, T1055.001) to the corresponding ATT&CK Tag in ThreatConnect. Once the conversion is complete, you can leverage ThreatConnect's ATT&CK Visualizer to view tactics, techniques, and sub-techniques used by Groups ingested from Flashpoint.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the App.

Flashpoint Intelligence Engine

After successfully configuring and activating the Feed API Service, you can access the Flashpoint Intelligence Engine user interface (UI). This UI allows you to interact with and manage the Flashpoint integration.

Follow these steps to access the UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services. The Services tab of the Playbooks screen will be displayed. 
3. Locate the Flashpoint Intelligence Engine - Flashpoint Intelligence Feed API Service and then click the link in the Service’s API Path field. The DASHBOARD screen of the Flashpoint Intelligence Engine UI will open in a new browser tab.

The following screens are available in the Flashpoint Intelligence Engine UI:

• DASHBOARD
• JOBS
• TASKS
• DOWNLOAD
• REPORT

DASHBOARD

The DASHBOARD screen (Figure 2) provides an overview of the total number of Events, Malware, Reports, Vulnerabilities, and Indicators retrieved from Flashpoint.

JOBS

The JOBS screen (Figure 3) breaks down the ingestion of Flashpoint data into manageable Job-like tasks.

• Job Type: If desired, select a Job type by which to filter Jobs. Available types include ad-hoc and scheduled. 
• Status:If desired, select a Job status by which to filter Jobs. Available statuses include the following:
  1. Download In Progress
  2. Download Complete
  3. Convert In Progress
  4. Convert Complete
  5. Upload In Progress
  6. Upload Complete
• Request ID: If desired, enter text into this box to search for a specific Job by its request ID.
• + Add Request: Click this button to display the ADD REQUEST window (Figure 4). On this window, you can specify the date range, data types, Indicator types, and Report tags for an ad-hoc Job request. After a Job request is added, it will be displayed in the table on the JOBS screen (Figure 3), and its Job type will be listed as ad-hoc.
  

   

TASKS

The TASKS screen (Figure 5) is where you can view and manage the Tasks for each Job.

DOWNLOADS

The DOWNLOADS screen (Figure 6) is where you can view data for Reports, Events, Indicators, and Vulnerabilities exactly as they appear in Flashpoint.

• Type: Select the type of object to download. Available options include Event and Indicator, Report, and Vulnerability.
• ID(s): Enter the Flashpoint ID(s) for the object(s) to download. Data will be retrieved in JavaScript^® Object Notation (JSON) format.
• Convert: Select this checkbox to convert the threat intelligence data to ThreatConnect batch format.
• Enrich: Select this checkbox to submit the threat intelligence data to the ThreatConnect Batch API.

REPORTS

The REPORTS screen provides two views: BATCH ERRORS and REPORT UPLOAD TRACKER. The BATCH ERRORS screen (Figure 7) displays batch errors for each request in a tabular format. Details provided for each error include the error’s code, message, and reason.

The REPORT UPLOAD TRACKER screen (Figure 8) is where you can view attempts ThreatConnect made to download Reports from Flashpoint. The table on this screen displays the most recent date on which ThreatConnect attempted to download a Report, the number of times an attempt to download the Report was made, and whether the Report was downloaded successfully. You can also search for Reports by ID on this screen, which can be useful if you do not see a Flashpoint Report in ThreatConnect as expected.

Data Mappings

The data mappings in Table 2 through Table 6 illustrate how data are mapped from Flashpoint Intelligence API endpoints into the ThreatConnect data model.

Events

ThreatConnect object type: Event Group

Indicators

ThreatConnect object type: Indicators (Address, ASN, Email Address, File, Host, Mutex, Registry Key, URL, User Agent)

Reports

ThreatConnect object type: Report Group

Vulnerabilities

ThreatConnect object type: Vulnerability Group

Malware

ThreatConnect object type: Malware Group

Frequently Asked Questions (FAQ)

When would I want to use the + Add Request button on the Jobs screen?

The + Add Request button on the Jobs screen allows you to make ad-hoc requests for data within a specific date range. To retrieve reports for specific data types, use the Downloads screen.

How do I convert Tags applied to Flashpoint data in ThreatConnect to ATT&CK Tags?

Add the ThreatConnect Source that contains the ingested Flashpoint data to the Approximate Match ATT&CK Tag conversion rule on the Tags tab of the System Settings screen in ThreatConnect. For instructions on performing this process, see the "Adding an Owner to a Conversion Rule" section of ATT&CK Tags.

Completing this step will allow you to leverage ThreatConnect's ATT&CK Visualizer to view tactics, techniques, and sub-techniques used by Groups ingested from Flashpoint.

How much historical data does the Flashpoint Intelligence Engine App ingest from Flashpoint into ThreatConnect?

The Flashpoint Intelligence Engine App ingests Flashpoint data from the last 90 days.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
Flashpoint^® is a registered trademark of Flashpoint.
JavaScript^® is a registered trademark of Oracle Corporation.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

30080-01 EN Rev. A