Intel 471 Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with Intel 471 Intelligence ingests Reports, Adversaries, Breaches, Malware, Vulnerabilities, and Indicators from Intel 471 into ThreatConnect. These Groups and Indicators are stored and associated in ThreatConnect with select relevant context.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key

Intel 471 Dependencies

• Active Intel 471 API key
• Active Intel 471 report subscriptions
  • Adversary Intelligence
  • Breach Intelligence
  • Malware Intelligence
  • Vulnerability Intelligence

Application Setup and Configuration

1. Log into ThreatConnect with a System Administrator account.
2. Install the Intel 471 Intelligence Engine App via TC Exchange™.
3. Use the ThreatConnect Feed Deployer to set up and configure the Intel 471 Intelligence Engine App.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the App.

Intel 471 Intelligence Engine App UI

After successfully configuring and activating the Feed API Service in ThreatConnect, you can access the Intel 471 Intelligence Engine App user interface (UI). This UI allows you to interact with and manage ThreatConnect's Intel 471 integration.

Follow these steps to access the Intel 471 Intelligence Engine App UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services. The Services tab of the Playbooks screen will be displayed. 
3. Locate the Intel 471 Intelligence Engine Feed API Service and then click the link in the Service’s API Path field. The DASHBOARD screen of the Intel 471 Intelligence Engine UI will open in a new browser tab.

The following screens are available in the Intel 471 Intelligence Engine App UI:

• DASHBOARD
• JOBS
• TASKS
• DOWNLOAD
• REPORT

DASHBOARD

The DASHBOARD screen (Figure 1) provides an overview of the total number of Adversaries, Adversary Reports, Breach Reports, Indicators, Malware, Malware Reports, Signatures, and Vulnerabilities retrieved from Intel 471.

JOBS

The JOBS screen (Figure 2) breaks down the ingestion of Intel 471 data into manageable Job-like tasks.

• Job Type: If desired, select a Job type by which to filter Jobs. Available types include ad-hoc and scheduled. 
• Status:If desired, select a Job status by which to filter Jobs. Available statuses include the following:
  1. Download In Progress
  2. Download Complete
  3. Convert In Progress
  4. Convert Complete
  5. Upload In Progress
  6. Upload Complete
• Request ID: If desired, enter text into this box to search for a specific Job by its request ID.
• + Add Request: Click this button to display the ADD REQUEST window (Figure 3). On this window, you can specify the date range and object types for an ad-hoc Job request. After a Job request is added, it will be displayed in the table on the JOBS screen (Figure 2), and its Job type will be listed as ad-hoc.
  

   

TASKS

The TASKS screen (Figure 4) is where you can view and manage the Tasks for each Job.

DOWNLOADS

The DOWNLOADS screen (Figure 5) is where you can view data for Adversaries, Breaches, Malware Families, and Vulnerabilities exactly as they appear in Intel 471.

• Type: Select the type of object to download. Available options include Adversary, Breach, Malware Families, and Vulnerability.
• ID(s): Enter the Intel 471 ID(s) for the object(s) to download. Data will be retrieved in JavaScript^® Object Notation (JSON) format.
• Convert: Select this checkbox to convert the threat intelligence data to ThreatConnect batch format.
• Enrich: Select this checkbox to submit the threat intelligence data to the ThreatConnect Batch API.

REPORTS

The REPORTS screen provides two views: BATCH ERRORS and REPORT UPLOAD TRACKER. The BATCH ERRORS screen (Figure 6) displays batch errors for each request in a tabular format. Details provided for each error include the error’s code, message, and reason.

The REPORT UPLOAD TRACKER screen (Figure 7) is where you can view attempts ThreatConnect made to download reports from Intel 471. The table on this screen displays the most recent date on which ThreatConnect attempted to download a report, the number of times an attempt to download the report was made, and whether the report was downloaded successfully. You can also search for reports by ID on this screen, which can be useful if you do not see an Intel 471 report in ThreatConnect as expected.

Data Mappings

The data mappings in Table 2 through Table 11 illustrate how data are mapped from Intel 471 Intelligence API endpoints into the ThreatConnect data model.

Actor

ThreatConnect object type: Adversary Group

Adversary Intelligence Report

ThreatConnect object type: Report Group

Malware Intelligence Report

ThreatConnect object type: Report Group

Related Indicators

ThreatConnect object type: Indicator (all types)

GIR Tags

ThreatConnect object type: Tags

Malware 

ThreatConnect object type: Malware Group

Malware Family YARA Signatures

ThreatConnect object type: Signature Group

Vulnerability Report Search

ThreatConnect object type: Vulnerability Group

Breach Alerts

ThreatConnect object type: Report Group

Entity

Frequently Asked Questions (FAQ)

Are there any limitations I should be aware of?

The first time you set up the Feed API Service, the data will backfill to 30 days. During the process of backfilling data for the prior 30 days, you may reach your Intel 471 API daily limit. To increase the API limit for your account, contact Intel 471. Note that this daily limit resets at midnight GMT.

If you continue to reach the Intel 471 API daily limit after the App backfills data for the last 30 days, it is recommended to select a greater value for the App's Update Time Interval In Hours setting.

How can I tell which Intel 471 report an Indicator is from? 

Any data ingested from Intel 471 will have one of these four Tags applied to them: 

• "Source: Intel 471 Adversary Intelligence Feed"
• "Source: Intel 471 Breach Intelligence Feed"
• "Source: Intel 471 Malware Intelligence Feed"
• "Source: Intel 471 Vulnerability Intelligence Feed" 

Why do I want to use the + Add Request button on the Jobs screen?

The + Add Request button on the Jobs screen allows you to make ad-hoc requests from a certain date range. To retrieve reports for specific object types, use the Downloads screen. 

How does the Intel 471 Intelligence Engine Feed API Service App differ from the previous Intel 471 Job App?

See Feed API Services for more information on how Feed API Service Apps function.

No new data are being ingested from Intel 471 into my ThreatConnect instance. What happened?

As you approach your Intel 471 API daily limit, Intel 471 will handle only one request per minute and then eventually return a 429 error until the daily limit resets at midnight GMT. Similarly, if there are multiple requests occurring at the same time, Intel 471 will handle one request per minute until the daily limit resets at midnight GMT. To increase the API limit for your account, contact Intel 471.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
JavaScript^® is a registered trademark of Oracle Corporation.

30078-02 EN Rev. A