Threat Intelligence

Adding Data to ThreatConnect

Contains articles describing how to create data in or upload data to ThreatConnect.

Adding Metadata to ThreatConnect Objects

Contain articles describing pieces of metadata, such as Attributes, Security Labels, and Tags, that can added to ThreatConnect objects.

7 Articles in this category

Associations

Contains articles describing associations in ThreatConnect, as well as the Associations card on the Overview tab of the Details screen for objects.

3 Articles in this category

ATT&CK Visualizer

Contains articles describing the ATT&CK Visualizer in ThreatConnect and the actions you can perform using this feature.

5 Articles in this category

Automated Data Services

Contains articles describing automated data services in ThreatConnect, including IP geolocation data, DNS resolutions, and WHOIS registration information.

4 Articles in this category

Browse

Contains articles describing the Browse screen and Details drawer in ThreatConnect.

3 Articles in this category

CAL

Contains articles related to ThreatConnect CAL.

5 Articles in this category

Enrichment

Contains articles related to third-party enrichment services built into ThreatConnect.

6 Articles in this category

Explore In Graph

Contains articles describing the Threat Graph feature in ThreatConnect and the actions you can perform using this feature.

8 Articles in this category

Exporting Data From ThreatConnect

Contains articles describing how to export threat intelligence data from ThreatConnect.

2 Articles in this category

False Positives

Contains articles describing the false positives feature in ThreatConnect.

4 Articles in this category

Filtering in the Technical Blogs and Reports Source

The "Technical Blogs and Reports" Source in ThreatConnect aggregates blog posts from over 90 open-source security blogs. This article describes how to identify blogs in the Source and find all Groups from a blog that contain certain keywords.

Updated on : 18 May 2023

Group Intel Rating

This article describes how to update a Group’s Intel Rating in ThreatConnect and view Intel Rating counts for Groups on the Browse screen.

Updated on : 05 May 2023

Indicator Status

This article defines the possibilities for Indicator Status in ThreatConnect set by ThreatConnect versus set by CAL. It demonstrates how to view and set Indicator Status for Indicators and override CAL's recommendations on a per-Indicator basis.

Updated on : 24 Aug 2023

Intelligence Requirements

2 Articles in this category

Managing File Hashes and Known File Occurrences

This article describes how to manage a File Indicator’s hashes, size, and File Occurrences. It also describes how to merge two File Indicators with different hash types into a single File Indicator containing both hashes.

Updated on : 06 Mar 2023

Modeling File Behavior

This article discusses how to view a File Indicator's behavior model, defines the various behavior types, and describes how to create File Indicator behavior associations.

Updated on : 19 Apr 2023

Pivoting on Data

This article describes how to pivot from Indicators, Groups, Tags, and Attributes in ThreatConnect.

Updated on : 05 May 2023

Private Indicators

This article describes how to mark an Indicator as private in ThreatConnect.

Updated on : 09 May 2023

Tag Normalization

This article describes Tag normalization in ThreatConnect, including how to create and manage Tag normalization rules, view details for main Tags, and identify when a main Tag is applied to an object.

Updated on : 26 Jul 2023

The Details Screen

This article describes the Details screen in ThreatConnect. Topics covered include viewing an object's Details screen, elements on the Overview tab of the Details screen, and the tabs available on the Details screen for specific object types.

Updated on : 31 Jul 2023

The Details Screen (Legacy)

This article describes the legacy Details screen in ThreatConnect. Topics covered include viewing an object's legacy Details screen, elements on the Overview tab, and the tabs available on the legacy Details screen for specific object types.

Updated on : 03 Aug 2023

The Feed Explorer

This article describes the Feed Explorer, which filters all My Intel Sources open-source feeds in ThreatConnect, presenting them in a table with their associated metric data and report cards.

Updated on : 25 Oct 2022

The "Last Modified" Date

This article describes the areas in ThreatConnect where you can view the date and time when an object was last modified. It also details whether certain actions you can perform update the date and time when an object was last modified.

Updated on : 15 Aug 2023

ThreatConnect Intelligence Anywhere

Contains articles describing ThreatConnect Intelligence Anywhere and the actions you can perform using this feature.

6 Articles in this category

ThreatConnect Query Language (TQL)

Contains articles describing how to use TQL to view and filter objects and how to construct TQL query expressions.

4 Articles in this category

Tracking Adversary Activity

This article describes how to create a Track based on Adversary assets, view domains found in a Track lookup and import them as associated Host Indicators to Groups, and export the Indicators into a CSV file.

Updated on : 19 Apr 2023