Intel 471 Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Intel 471 Intelligence ingests Reports, Adversaries, Breaches, Malware, Vulnerabilities, and Indicators from Intel 471 into ThreatConnect. These Groups and Indicators are stored and associated in ThreatConnect with select relevant context.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key

Intel 471 Dependencies

• Active Intel 471 API key
• Active Intel 471 report subscriptions
  • Adversary Intelligence
  • Breach Intelligence
  • Malware Intelligence
  • Vulnerability Intelligence

Application Setup and Configuration

Follow these steps to install and configure the Intel 471 Intelligence Engine App via  TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. From the Settingsmenu on the navigation bar, select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the Intel 471 Intelligence Engine App on the Catalog tab. Then click Install in the Options column to install the App.
4. After you install the Intel 471 Intelligence Engine App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the Intel 471 Intelligence Engine App. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the App.

Intel 471 Intelligence Engine App UI

After successfully configuring and activating the Feed API Service, you can access the Intel 471 Intelligence Engine App user interface (UI). This UI allows you to interact with and manage ThreatConnect’s Intel 471 Intelligence integration.

Follow these steps to access the Intel 471 Intelligence Engine App UI:

1. Log into ThreatConnect with a System Administrator account.
2. From the Automation & Feeds dropdown on the top navigation bar, select Services. 
3. Locate and turn on the Intel 471 Intelligence Engine Feed API Service.
4. Click the link in the Service’s API Path field. The Intel 471 Intelligence Engine App will open in a new browser tab.

The following screens are available in the Intel 471 Intelligence Engine App UI:

• Dashboard
• Jobs
• Tasks
• Download
• Batch Errors
• Attachment Status

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of Adversary Reports, Breach Reports, Indicators, Malware Reports, Signatures, and Vulnerabilities retrieved from Intel 471.

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of Intel 471 Intelligence Engine data into manageable Job-like tasks, displaying all processes that are pending, in progress, complete, and failed. The ⋯ menu in a Job’s row provides the following options:

• Details: View details for the Job, such as download, convert, and upload start and complete times and counts of downloaded and batched Groups and Indicators.
• Download Files: Download metadata files for all Jobs and data (convert, download, and upload) files for completed Jobs.
• Batch Errors: View errors that have occurred for the Job on the Batch Errors screen.

You can filter Intel 471 Intelligence Engine App Jobs by the following elements:

• Job ID: Enter text into this box to search for a Job by its Job ID.
• Job Type: Select Job types to display on the Jobs screen.
• Status: Select Job statuses to display on the Jobs screen.

Add a Job

You can add ad-hoc Jobs on the Jobs screen. Follow these steps to create a request for an ad-hoc Job for the Intel 471 Intelligence Engine App:

1. Click Add Job (Figure 2).
2. Fill out the fields on the Add Job drawer (Figure 3) as follows:

• Start Time: (Optional) Enter the time at which the Job should start.
• End Time: (Optional) Enter the time by which the Job should end.
• Types: (Optional) Select the object types to include in the Job. 
• Click Submit to submit the request for the ad-hoc Job.

Tasks

The Tasks screen (Figure 4) displays all Tasks that may be part of a Job, including each step of the download, convert, and upload processes, as well as Tasks for the ThreatConnect Intel 471 Intelligence Engine App, such as Monitor, Schedule Downloads, and Cleaner. The current status (Idle, Paused, or Running), name, description, and heartbeat timeout length, in minutes, are displayed for each Task. The ⋯ menu in a Task’s row provides the following options, depending on the Task’s status:

• Run (idle and paused Tasks only)
• Pause (idle and running Tasks only)
• Resume (paused Tasks only)
• Kill (running Tasks only)

Under the table is a dashboard where you can view runtime analytics.

Download

The Download screen (Figure 5) lets you download JavaScript® Object Notation (JSON) data for Intel 471 objects and then upload the data into ThreatConnect. 

Follow these steps to download JSON data for an Intel 471 Intelligence object on the Download screen and then upload the data into ThreatConnect:

1. Type: Select an Intel 471 Intelligence object type to download.
2. External ID: Enter one or more Intel 471 External IDs for the objects to download, separating each ID with a comma.
3. Click Download. The JSON data will be displayed in two columns: Results (raw JSON data) and Converted (JSON data in ThreatConnect batch format) (Figure 6).
4. Click Upload to submit the converted Threat intelligence data via the ThreatConnect Batch API.

Batch Errors

The Batch Errors screen (Figure 7) displays an overview of the batch error types that have occurred for Job requests. You can enter keywords to filter by Job ID.

Select an error type to open a drawer containing a table with details on all batch errors of that type (Figure 8). You can enter keywords to filter by reason for error.

Attachment Status

The AttachmentStatus screen (Figure 9) displays a table with details on ThreatConnect's attempts to download Report attachments from Intel 471 Intelligence. You can enter Intel 471 External IDs for Groups to filter the table by Group ID, which can be useful if you do not see an Intel 471 Intelligence attachment in ThreatConnect as expected, or by status.

Data Mappings

The data mappings in Table 2 through Table 11 illustrate how data are mapped from Intel 471 Intelligence API endpoints into the ThreatConnect data model.

Actor

ThreatConnect object type: Adversary Group

Adversary Intelligence Report

ThreatConnect object type: Report Group

Malware Intelligence Report

ThreatConnect object type: Report Group

Related Indicators

ThreatConnect object type: Indicator (all types)

GIR Tags

ThreatConnect object type: Tags

Malware 

ThreatConnect object type: Malware Group

Malware Family YARA Signatures

ThreatConnect object type: Signature Group

Vulnerability Report Search

ThreatConnect object type: Vulnerability Group

Breach Alerts

ThreatConnect object type: Report Group

Entity

Frequently Asked Questions (FAQ)

Are there any limitations I should be aware of?

The first time you set up the Feed API Service for the Intel 471 Intelligence Engine App, the data will backfill to 30 days. During the process of backfilling data for the prior 30 days, you may reach your Intel 471 API daily limit. To increase the API limit for your account, contact Intel 471. Note that this daily limit resets at midnight GMT.

If you continue to reach the Intel 471 API daily limit after the App backfills data for the last 30 days, it is recommended to select a greater value for the App's Advanced Settings parameter to increase the interval at which Intel 471 data are ingested.

Follow these steps to update the Advanced Settings parameter for the Intel 471 Intelligence Engine App:

1. From the ⋮ menu for the Intel 471 Intelligence Engine App on the Services screen, select Edit.
2. On Step 3 (Parameters) of the Edit Service drawer, increase the value of the Advanced Settings parameter. The unit for this field is days. If the field for this parameter is blank, then the current value is the default of 1 day.
3. Click SAVE.
   

Why are no new data are being ingested from Intel 471 into my ThreatConnect instance?

As you approach your Intel 471 API daily limit, Intel 471 will handle only one request per minute and then eventually return a 429 error until the daily limit resets at midnight GMT. Similarly, if there are multiple requests occurring at the same time, Intel 471 will handle one request per minute until the daily limit resets at midnight GMT. To increase the API limit for your account, contact Intel 471.

How can I tell which Intel 471 report an Indicator is from?

Any data ingested from Intel 471 will have one of these four Tags applied to them:

• "Source: Intel 471 Adversary Intelligence Feed"
• "Source: Intel 471 Breach Intelligence Feed"
• "Source: Intel 471 Malware Intelligence Feed"
• "Source: Intel 471 Vulnerability Intelligence Feed"

When would I use the Add Job feature on the Jobs screen?

The Add Job feature on the Jobs screen allows you to make ad-hoc requests for one or more of the Intel 471 products in a certain date range. If you want to retrieve specific reports or other objects, use the Downloads screen.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
JavaScript^® is a registered trademark of Oracle Corporation.

30078-03 EN Rev. A