Threat Intelligence

Adding Data to ThreatConnect

Contains articles describing how to create data in or upload data to ThreatConnect.

Adding Metadata to ThreatConnect Objects

Contain articles describing pieces of metadata, such as Attributes, Security Labels, and Tags, that can added to ThreatConnect objects.

11 Articles in this category

CAL

Contains articles related to ThreatConnect CAL.

9 Articles in this category

Exporting Data From ThreatConnect

Contains articles describing how to export threat intelligence data from ThreatConnect.

2 Articles in this category

Viewing Threat Intelligence Data

Contains articles describing how to view threat intelligence data in ThreatConnect.

5 Articles in this category

Associations

Contains articles describing associations in ThreatConnect, as well as the Associations card on the Overview tab of the Details screen for objects.

3 Articles in this category

ATT&CK Visualizer

Contains articles describing the ATT&CK Visualizer in ThreatConnect and the actions you can perform using this feature.

6 Articles in this category

Automated Data Services

Contains articles describing automated data services in ThreatConnect, including IP geolocation data, DNS resolutions, and WHOIS registration information.

4 Articles in this category

Enrichment

This article provides an overview of the built-in third-party enrichment services available for Indicators in ThreatConnect.

Updated on : 11 Mar 2025

Threat Graph

This article provides an overview of the Threat Graph feature in ThreatConnect.

Updated on : 17 Jan 2025

False Positives

Contains articles describing the false positives feature in ThreatConnect.

4 Articles in this category

Indicator Status

This article defines the possibilities for Indicator Status in ThreatConnect set locally or by CAL. It also describes how to view and set Indicator Status for Indicators and override CAL’s recommendations on a per-Indicator basis.

Updated on : 10 Feb 2025

Intelligence Requirements

This article provides an overview of Intelligence Requirements in ThreatConnect, which are objects defined by logic-based keyword queries that identify and retrieve relevant information in your ThreatConnect owners.

Updated on : 15 Jul 2024

MITRE ATT&CK AI Classification in ThreatConnect

This article explains how the MITRE ATT&CK AI classification model works in ThreatConnect, describes the areas in ThreatConnect that leverage the model, and lists the techniques and sub-techniques used in the model.

Updated on : 17 Oct 2024

Modeling File Behavior

This article discusses how to view a File Indicator's behavior model, defines the various behavior types, and describes how to create File Indicator behavior associations.

Updated on : 19 Apr 2023

OSINT and CAL Feeds

This article provides a list of open-source intelligence (OSINT) and CAL feeds included in ThreatConnect by default.

Updated on : 22 Jul 2024

Pivoting on Data

This article describes how to pivot from Indicators, Groups, Tags, and Attributes in ThreatConnect.

Updated on : 03 Dec 2024

Private Indicators

This article describes how to mark an Indicator as private in ThreatConnect.

Updated on : 09 May 2023

Tag Normalization

This article describes Tag normalization in ThreatConnect, including how to create and manage Tag normalization rules, view details for main Tags, and identify when a main Tag is applied to an object.

Updated on : 18 Mar 2025

The Feed Explorer

This article describes the Feed Explorer, which filters all My Intel Sources open-source feeds in ThreatConnect, presenting them in a table with their associated metric data and report cards.

Updated on : 30 Oct 2023

The "Last Modified" Date

This article describes the areas in ThreatConnect where you can view the date and time when an object was last modified. It also details whether certain actions you can perform update the date and time when an object was last modified.

Updated on : 25 Nov 2024

ThreatConnect Intelligence Anywhere

Contains articles describing ThreatConnect Intelligence Anywhere and the actions you can perform using this feature.

7 Articles in this category

ThreatConnect Query Language (TQL)

The article provides an overview of ThreatConnect Query Language (TQL) and highlights use cases for this feature.

Updated on : 15 Jan 2025

Tracking Adversary Activity

This article describes how to create a Track based on Adversary assets, view domains found in a Track lookup and import them as associated Host Indicators to Groups, and export the Indicators into a CSV file.

Updated on : 27 Mar 2024