Skip to main content

ThreatConnect

Details
Content
Dependencies
Version History

Download With Dependencies

Threat intelligence platform.

Classifiers

Name	Description
Threatconnect Mapper (incoming)
Threatconnect classifier

Incident Types

Name	Description
ThreatConnect

Layouts

Name	Description
ThreatConnect Layout

Incident Fields

Name	Description
ThreatConnect Security Labels
ThreatConnect Attributes
ThreatConnect Associated Indicators
ThreatConnect Victim Assets
ThreatConnect Created By
ThreatConnect Group Type	The association to bind to the tpeName field from Threatconnect.
ThreatConnect AssociatedGroups
ThreatConnect Id	The association to bind to the id field from Threatconnect.
ThreatConnect Event Date	The association to bind to the event date field from Threatconnect.

Integrations

Name	Description
ThreatConnect v3	ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
ThreatConnect v2	ThreatConnect's intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
ThreatConnect (Deprecated)	Deprecated. Use the ThreatConnect v2 integration instead.

Classifiers

Name	Description
Threatconnect Mapper (incoming)
Threatconnect classifier

Incident Types

Name	Description
ThreatConnect

Incident Fields

Name	Description
ThreatConnect Security Labels
ThreatConnect Attributes
ThreatConnect Associated Indicators
ThreatConnect Victim Assets
ThreatConnect Created By
ThreatConnect Group Type	The association to bind to the tpeName field from Threatconnect.
ThreatConnect AssociatedGroups
ThreatConnect Id	The association to bind to the id field from Threatconnect.
ThreatConnect Event Date	The association to bind to the event date field from Threatconnect.

Integrations

Name	Description
ThreatConnect v3	ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
ThreatConnect v2	ThreatConnect's intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
ThreatConnect (Deprecated)	Deprecated. Use the ThreatConnect v2 integration instead.

3.0.1 - 3720747 (September 24, 2022)

Integrations

ThreatConnect v3

Added support for get indicators by summary.

Related pull requests:
- 21403

Download

3.0.0 - 3649843 (September 13, 2022)

Classifiers

New: Threatconnect classifier

Added a classifier for the fetched incidents.
Updated the Docker image to: demisto/python3:3.10.7.33922.

Incident Fields

ThreatConnect Event Date
ThreatConnect Group Type
ThreatConnect Id
ThreatConnect Associated Indicators
ThreatConnect AssociatedGroups
ThreatConnect Attributes
ThreatConnect Created By
ThreatConnect Security Labels
ThreatConnect Victim Assets

Incident Types

ThreatConnect
Added the incident type for threatconnect.

Integrations

New: ThreatConnect v3

Added a rest API v3 support, ThreatConnect's integration is a intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.

Layouts

New: ThreatConnect Layout
Added a layout for the fetched incidents.

Related pull requests:
- 19793

Download

2.0.19 - 3326856 (July 25, 2022)

Integrations

ThreatConnect v2

Fixed an issue where the ip command returned incorrect data.

Related pull requests:
- 19746

Download

2.0.18 - 3083568 (June 13, 2022)

Integrations

ThreatConnect v2

Added the limit argument to tc-get-indicators-by-tag command.

Related pull requests:
- 19499

Download

2.0.17 - R2146019 (December 21, 2021)

Integrations

ThreatConnect v2

Fixed an issue where indicators enriched using the file command did not show the ThreatConnect vendor name.

2.0.16 - 1855807 (October 27, 2021)

Integrations

ThreatConnect v2

Added the owner argument to the tc-update-indicator command.
Updated the Docker image to: demisto/threatconnect-py3-sdk:1.0.0.23423.

2.0.15 - 397182 (July 13, 2021)

Integrations

ThreatConnect v2

Added support for new output: WebLink
Updated the Docker image to: demisto/threatconnect-py3-sdk:1.0.0.21898.

2.0.14 - 325014 (April 11, 2021)

Integrations

ThreatConnect v2

Added the indicator attributes to the outputs of the tc-get-indicator command.

2.0.13 - 312966 (March 25, 2021)

Integrations

ThreatConnect v2

Added support for the Source Reliability integration parameter.

2.0.12 - 269341 (February 2, 2021)

Integrations

ThreatConnect v2

Fixed display names for various integration parameters.

2.0.11 - R264879 (January 27, 2021)

Integrations

ThreatConnect v2

Fixed an issue where the security_label argument was not used correctly in the tc-create-document-group command.
Removed the updatedValues argument from the tc-update-indicator command since it is not in use.

2.0.10 - 255754 (January 18, 2021)

Integrations

ThreatConnect (Deprecated)

Documentation and metadata improvements.

2.0.9 - R253472 (January 16, 2021)

Integrations

ThreatConnect v2

Fixed an issue in the reputation commands where fetching indicators from multiple owners did not work.
Upgraded the Docker image to demisto/threatconnect-py3-sdk:1.0.0.12410.

2.0.8 - R124496 (September 23, 2020)

Integrations

ThreatConnect (Deprecated)

Maintenance and stability enhancements

2.0.7 - 114151 (September 13, 2020)

Integrations

ThreatConnect v2

The DBotScore calculation now works as expected.

2.0.6 - 103501 (September 3, 2020)

Integrations

ThreatConnect v2

Added support for fetching indicators from multiple owners.

2.0.5 - 91758 (August 20, 2020)

Integrations

ThreatConnect v2

Fixed an issue where the DBotScore calculation did not work as intended.

2.0.4 - 88924 (August 16, 2020)

Integrations

ThreatConnect v2

Added the tc-download-report command to download group reports in PDF.

2.0.3 - R82293 (August 5, 2020)

Integrations

ThreatConnect v2

Replaced the ProxyIP and ProxyPort configuration parameterss with the standard System Proxy configuration parameter. If you already configured the ProxyIP and ProxyPort parameters, make sure to switch to (re-configure) using the System Proxy parameter.

2.0.2 - R72890 (July 23, 2020)

Integrations

ThreatConnect v2

Fixed an issue where the tc-group-associate-indicator command failed to associate URL indicators.

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 23, 2020
Last Release	September 24, 2022

WORKS WITH THE FOLLOWING INTEGRATIONS:

ThreatConnect (Deprecated)

ThreatConnect v2

ThreatConnect v3

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.