Threat Intelligence

Adding Data to ThreatConnect

Contains articles describing how to create data in or upload data to ThreatConnect.

Adding Metadata to ThreatConnect Objects

Contain articles describing pieces of metadata, such as Attributes, Security Labels, and Tags, that can added to ThreatConnect objects.

6 Articles in this category

Associations

Contains articles describing associations in ThreatConnect, as well as the Associations card on the Overview tab of the Details screen for objects.

4 Articles in this category

Automated Data Services

Contains articles describing automated data services in ThreatConnect, including IP geolocation data, DNS resolutions, and WHOIS registration information.

4 Articles in this category

Browse

Contains articles describing the Browse screen in ThreatConnect and the actions you can perform on this screen.

3 Articles in this category

CAL

Contains articles related to ThreatConnect's Collective Analytics Layer (CAL)

5 Articles in this category

Explore In Graph

Contains articles describing the Explore In Graph feature in ThreatConnect and the actions you can perform using this feature.

10 Articles in this category

Exporting Groups

This article describes how to export a set of Groups selected from the Browse screen into a comma-separated values (CSV) file.

Updated on : 25 Jan 2023

Exporting Indicators

This article describes how to export a set of Indicators selected from the Browse screen or associated to a Group or to another Indicator from ThreatConnect into a comma-separated values (CSV) file.

Updated on : 08 Sep 2022

False Positives

Contains articles describing the false positives feature in ThreatConnect.

4 Articles in this category

Filtering in the Technical Blogs and Reports Source

The "Technical Blogs and Reports" Source in ThreatConnect aggregates blog posts from over 90 open-source security blogs. This article describes how to identify blogs in the Source and find all Groups from a blog that contain certain keywords.

Updated on : 08 Sep 2022

Group Intel Rating

This article describes how to update a Group’s Intel Rating in ThreatConnect and view Intel Rating counts for Groups on the Browse screen.

Updated on : 19 Jan 2023

Indicator Status

This article defines the possibilities for Indicator Status in ThreatConnect set by ThreatConnect versus set by CAL. It demonstrates how to view and set Indicator Status for Indicators and override CAL's recommendations on a per-Indicator basis.

Updated on : 24 Oct 2022

Modeling File Behavior

This article discusses how to view a File Indicator's behavior model, defines the various behavior types, and describes how to create File Indicator behavior associations.

Updated on : 24 Oct 2022

Pivoting on Data

This article describes how to pivot on Indicators, Groups, Tags, and Attributes in ThreatConnect.

Updated on : 24 Oct 2022

Private Indicators

This article describes how to mark an Indicator as private in ThreatConnect.

Updated on : 28 Nov 2022

The Details Screen

This article describes the Details screen in ThreatConnect. Topics covered include viewing an object's Details screen, elements on the Overview tab of the Details screen, and the tabs available on the Details screen for specific object types.

Updated on : 20 Jan 2023

The Details Screen (Legacy)

This article describes the legacy Details screen in ThreatConnect. Topics covered include viewing an object's legacy Details screen, elements on the Overview tab, and the tabs available on the legacy Details screen for specific object types.

Updated on : 20 Jan 2023

The Enrichment Tab

This article describes how to view data returned from a third-party enrichment service for an Indicator on the Enrichment tab of an Indicator’s Details screen in ThreatConnect.

Updated on : 18 Jan 2023

The Feed Explorer

This article describes the Feed Explorer, which filters all My Intel Sources open-source feeds in ThreatConnect, presenting them in a table with their associated metric data and report cards.

Updated on : 25 Oct 2022

The "Last Modified" Date

This article describes the areas in ThreatConnect where you can view the date and time when an object was last modified. It also details whether certain actions you can perform update the date and time when an object was last modified.

Updated on : 21 Oct 2022

ThreatConnect Browser Extension

Contains articles describing the ThreatConnect Browser Extension and the actions you can perform using this feature.

7 Articles in this category

ThreatConnect Query Language (TQL)

Contains articles describing how to use TQL to view and filter objects and how to construct TQL query expressions.

4 Articles in this category

Tracking Adversary Activity

This article describes how to create a Track based on Adversary assets, view domains found in a Track lookup and import them as associated Host Indicators to Groups, and export the Indicators into a CSV file.

Updated on : 26 Oct 2022

Setting Indicator Threat and Confidence Ratings

This article defines Threat Rating and Confidence Rating for Indicators in ThreatConnect and demonstrates how to set these values for an Indicator.

Updated on : 19 Oct 2022