Console
    Contact Us Start free

    Integrate Anomali ThreatStream with Google SecOps

    This document describes how to integrate Anomali ThreatStream with Google Security Operations (Google SecOps).

    Integration version: 11.0

    Integration parameters

    Use the following parameters to configure the integration:

    Parameter name Type Default value Is mandatory Description
    Web Root
    		 String https://siemplify.threatstream.com Yes

    Web Root of the Anomali ThreatStream instance.

    This parameter is used for creating report links across integration items.
    API Root
    		 String https://api.threatstream.com Yes API Root of the Anomali ThreatStream instance.
    Email Address
    		 String N/A Yes Email address of the Anomali ThreatStream account.
    API Key
    		 Password N/A Yes API key of the Anomali ThreatStream account.
    Verify SSL
    		 Checkbox Checked Yes If enabled, verifies that the SSL certificate for the connection to the Anomali ThreatStream server is valid.

    For instructions about how to configure an integration in Google SecOps, see Configure integrations .

    You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

    Actions

    For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

    Add Tags To Entities

    Add tags to entities in Anomali ThreatStream.

    Parameters

    Parameter name Type Default value Is mandatory Description
    Tags
    		 CSV N/A Yes Specify a comma-separated list of tags that need to be added to entities in Anomali ThreatStream.

    Run On

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one hash across entities is found (is_success=true): "Successfully added tags to the following entities in Anomali ThreatStream:\n{0}".format(entity.identifier list)

    If not found specific entities (is_success=true): "The following entities were not found in Anomali ThreatStream\n: {0}".format([entity.identifier])

    If not found all entities (is_success=false): "None of the provided entities were found."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Add Tags To Entities". Reason: {0}''.format(error.Stacktrace)

    		 General

    Enrich entities

    Retrieve information about IPs, URLs, hashes, email addresses from Anomali ThreatStream.

    Parameters

    Parameter name
    Type
    Default value
    Is mandatory
    Description
    Severity Threshold
    DDL

    Low

    Possible values:

    • Very High
    • High
    • Medium
    • Low
    Yes
    Specify what should be the severity threshold for the entity, in order to mark it as suspicious. If multiple records are found for the same entity, action will take the highest severity out of all available records.
    Confidence Threshold
    Integer
    N/A
    Yes
    Specify what should be the confidence threshold for the entity, in order to mark it as suspicious. Note: Maximum is 100. If multiple records are found for the entity, action will take the average. Active records have priority.
    Ignore False Positive Status
    Checkbox
    Unchecked
    No
    If enabled, action will ignore the false positive status and mark the entity as suspicious based on the Severity Threshold and Confidence Threshold. If disabled, action will never label false positive entities as suspicious, regardless, if they pass the Severity Threshold and "Confidence Threshold" conditions or not.
    Add Threat Type To Case
    Checkbox
    Unchecked
    No
    If enabled, action will add threat types of the entity from all records as tags to the case. Example: apt
    Only Suspicious Entity Insight
    Checkbox
    Unchecked
    Yes
    If enabled, action will create insight only for entities that exceeded the Severity Threshold and Confidence Threshold.
    Create Insight
    Checkbox
    Unchecked
    Yes
    If enabled, action will add an insight per processed entity.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    Entity enrichment
    Enrichment field name Logic - When to apply
    id When available in JSON
    status When available in JSON
    itype When available in JSON
    expiration_time When available in JSON
    ip When available in JSON
    feed_id When available in JSON
    confidence When available in JSON
    uuid When available in JSON
    retina_confidence When available in JSON
    trusted_circle_ids When available in JSON
    source When available in JSON
    latitude When available in JSON
    type When available in JSON
    description When available in JSON
    tags When available in JSON
    threat_score When available in JSON
    source_confidence When available in JSON
    modification_time When available in JSON
    org_name When available in JSON
    asn When available in JSON
    creation_time When available in JSON
    tlp When available in JSON
    country When available in JSON
    longitude When available in JSON
    severity When available in JSON
    subtype When available in JSON
    report When available in JSON
    Case wall
    Result type
    Description
    Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one of the provided entities is enriched (is_success=true): "Successfully enriched the following entities using Anomali ThreatStream: \n {0}".format(entity.identifier list)

    If failed to enrich specific entities (is_success=true): "Action was not able to enrich the following entities using Anomali ThreatStream\n: {0}".format([entity.identifier])

    If failed to enrich all entities (is_success=false): "No entities were enriched."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace)

    If the "Confidence Threshold" parameter is not in the 0-100 range: "'Confidence Threshold' value should be in range from 0 to 100."

    General
    Case Wall Table

    Table Name:Related Analysis Links: {entity_identifier}

    Table Columns:

    • Name
    • Link
    General
    Case Wall Table
    Keys based on the enrichment table
    Entity

    Retrieve entity related associations from Anomali ThreatStream.

    Parameters

    Parameter name Type Default value Is mandatory Description
    Return Campaigns
    		 Checkbox Checked No If enabled, action will fetch related campaigns and details about them.
    Return Threat Bulletins
    		 Checkbox Checked No If enabled, action will fetch related threat bulletins and details about them.
    Return Actors
    		 Checkbox Checked No If enabled, action will fetch related actors and details about them.
    Return Attack Patterns
    		 Checkbox Checked No If enabled, action will fetch related attack patterns and details about them.
    Return Courses Of Action
    		 Checkbox Checked No If enabled, action will fetch related courses of action and details about them.
    Return Identities
    		 Checkbox Checked No If enabled, action will fetch related identities and details about them.
    Return Incidents
    		 Checkbox Checked No If enabled, action will fetch related incidents and details about them.
    Return Infrastructure
    		 Checkbox Checked No If enabled, action will fetch related infrastructure and details about them.
    Return Intrusion Sets
    		 Checkbox Checked No If enabled, action will fetch related intrusion sets and details about them.
    Return Malware
    		 Checkbox Checked No If enabled, action will fetch related malware and details about them.
    Return Signatures
    		 Checkbox Checked No If enabled, action will fetch related signatures and details about them.
    Return Tools
    		 Checkbox Checked No If enabled, action will fetch related tools and details about them.
    Return TTPs
    		 Checkbox Checked No If enabled, action will fetch related TTPs and details about them.
    Return Vulnerabilities
    		 Checkbox Checked No If enabled, action will fetch related vulnerabilities and details about them.
    Create Campaign Entity
    		 Checkbox Unchecked No If enabled, action will create an entity out of available Campaign associations.
    Create Actors Entity
    		 Checkbox Unchecked No If enabled, action will create an entity out of available Actor associations.
    Create Signature Entity
    		 Checkbox Unchecked No If enabled, action will create an entity out of available Signature associations.
    Create Vulnerability Entity
    		 Checkbox Unchecked No If enabled, action will create an entity out of available Vulnerability associations.
    Create Insight
    		 Checkbox Checked No If enabled, action will create an insight based on the results.
    Create Case Tag
    		 Checkbox Unchecked No If enabled, action will create case tags based on the results.
    Max Associations To Return
    		 Integer 5 No Specify how many associations to return per type. Default: 5
    Max Statistics To Return
    		 Integer 3 No Specify how many top statistics results regarding IOCs to return. Note: The action will at max process 1000 IOCs related to the association. If you provide 0 , action doesn't try to fetch statistics information.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    JSON result
      { 
  
 "campaign" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Example 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Example 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "actor" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Actor 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Actor 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "attackpattern" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Pattern 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Pattern 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "courseofaction" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Course of Action 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Course Of Action 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "identity" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Identity 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Identity 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "incident" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Incident 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Incident 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "infrastructure" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Infrustructure 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Infrustructure 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "intrusionset" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Intrusion set 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Intrusion set 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "malware" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Malware 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Malware 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "signature" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Signature 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Signature 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "tool" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Tool 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Tool 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "ttp" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "TTP 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "TTP 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
  
 "vulnerability" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "Vulnerability 1" 
 , 
  
 "id" 
 : 
  
 1 
  
 }, 
  
 { 
  
 "name" 
 : 
  
 "Vulnerability 2" 
 , 
  
 "id" 
 : 
  
 2 
  
 } 
  
 ], 
 }
    Case wall
    Result type
    Description
    Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one association across entities is found (is_success=true): "Successfully retrieved related associations from Anomali ThreatStream"

    If no associations are found (is_success=false) : "No related associations were found."

    Async Message: "Waiting for all of the association details to be retrieved"

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Get Related Association". Reason: {0}''.format(error.Stacktrace)

    General
    Case Wall Table

    Table Name:"Related Associations"

    Table Columns:

    • ID
    • Name
    • Type
    • Status

    Retrieve related entities based on the associations in Anomali ThreatStream.

    Parameters

    Parameter name Type Default value Is mandatory Description
    Confidence Threshold
    		 Integer N/A Yes Specify what should be the confidence threshold. Maximum is 100.
    Search Threat Bulletins
    		 Checkbox Checked No If enabled, action will search among threat bulletins.
    Search Actors
    		 Checkbox Checked No If enabled, action will search among actors.
    Search Attack Patterns
    		 Checkbox Checked No If enabled, action will search among attack patterns.
    Search Campaigns
    		 Checkbox Checked No If enabled, action will search campaigns.
    Search Courses Of Action
    		 Checkbox Checked No If enabled, action will search among courses of action.
    Search Identities
    		 Checkbox Checked No If enabled, action will search among identities.
    Search Incidents
    		 Checkbox Checked No If enabled, action will search among incidents.
    Search Infrastructures
    		 Checkbox Checked No If enabled, action will search among infrastructures.
    Search Intrusion Sets
    		 Checkbox Checked No If enabled, action will search among intrusion sets.
    Search Malware
    		 Checkbox Checked No If enabled, action will search among malware.
    Search Signatures
    		 Checkbox Checked No If enabled, action will search among signatures.
    Search Tools
    		 Checkbox Checked No If enabled, action will search among tools.
    Search TTPs
    		 Checkbox Checked No If enabled, action will search among ttps.
    Search Vulnerabilities
    		 Checkbox Checked No If enabled, action will search among vulnerabilities.
    Max Entities To Return
    		 Integer 50 No Specify how many entities to return per entity type.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email (user entity that matches email regex)
    • Threat Actor
    • CVE

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    JSON result
      { 
 "{}_hashes.format(subtype)" 
 : 
  
 [ 
 "" 
 ], 
 "all_hashes" 
 : 
  
 [ 
 "md5hash_1" 
 ], 
 "domains" 
 : 
  
 [ 
 "" 
 ] 
 "urls" 
 : 
  
 [] 
 "emails" 
 : 
  
 [] 
 "ips" 
 : 
  
 [] 
 }
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one hash across entities is found (is_success=true): "Successfully retrieved related hashes from Anomali ThreatStream"

    If no hashes are found (is_success=false): "No related hashes were found."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Get Related Hashes". Reason: {0}''.format(error.Stacktrace)

    If the "Confidence Threshold" parameter is not in 0-100 range: "'Confidence Threshold' value should be in range from 0 to 100."

    		 General

    Ping

    Test the connectivity to Anomali ThreatStream.

    Parameters

    N/A

    Run on

    This action doesn't run on entities, nor has mandatory input parameters.

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful: "Successfully connected to the Anomali ThreatStream server with the provided connection parameters!"

    The action should fail and stop a playbook execution:

    If not successful: "Failed to connect to the Anomali ThreatStream server! Error is {0}".format(exception.stacktrace)

    		 General

    Remove Tags From Entities

    Remove tags from entities in Anomali ThreatStream. Supported entities: Hash, URL, IP Address, Email Address (user entity that matches email regex).

    Parameters

    Parameter name Type Default value Is mandatory Description
    Tags
    		 CSV N/A Yes Specify a comma-separated list of tags that need to be removed from entities in Anomali ThreatStream.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one tag is removed from one entity (is_success=true): "Successfully removed the following tags from the "{entity.identifier}" entity in Anomali ThreatStream:\n{0}".format(tags)

    If one tag is not found for one entity (is_success=true): "The following tags were already not a part of "{entity.identifier}" entity in Anomali ThreatStream:\n{0}".format(tags)

    If all tags are not found for one entity (is_success=true): "None of the provided tags were part of "{entity.identifier}" entity in Anomali ThreatStream."

    If one entity is not found (is_success=true): "The following entities were not found in Anomali ThreatStream\n: {0}".format([entity.identifier])

    If all entities are not found (is_success=false): "None of the provided entities were found."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Remove Tags From Entities". Reason: {0}''.format(error.Stacktrace)

    		 General

    Report As False Positive

    Report entities in Anomali ThreatStream as false positive. Supported entities: Hash, URL, IP Address, Email Address (user entity that matches email regex).

    Parameters

    Parameter name Type Default value Is mandatory Description
    Reason
    		 String N/A Yes Specify the reason why you want to mark entities as false positives.
    Comment
    		 String N/A Yes Specify additional information related to your decision regarding marking the entity as false positive.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email Address (user entity that matches email regex)

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one hash across entities is found (is_success=true): "Successfully reported the following entities as false positive in Anomali ThreatStream:\n{0}".format(entity.identifier list)

    If fail to mark specific entities (is_success=true): "Action was not able to report the following entities as false positive in Anomali ThreatStream\n: {0}".format([entity.identifier])

    If fail to enrich all entities (is_success=false): "No entities were reported as false positive."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Report As False Positive". Reason: {0}''.format(error.Stacktrace)

    		 General

    Submit Observables

    Submit an observable to Anomali ThreatStream based on IP, URL, Hash, Email entities. Supported entities: Hash, URL, IP Address, Email Address (user entity that matches email regex).

    Where to find trusted circle IDs

    To find the ID of a trusted circle, locate the trusted circle on Anomali ThreatStream, and click its name. The URL displayed in the address bar shows the ID, such as https://siemplify.threatstream.com/search?trustedcircles=13.

    Parameters

    Parameter name
    Type
    Default value
    Is mandatory
    Description
    Classification
    DDL

    Private

    Possible values:

    • Public
    • Private
    Yes
    Specify the classification of the observable.
    Threat Type
    DDL

    APT

    Possible Values

    • APT
    • Adware
    • Anomalous
    • Anomyzation
    • Bot
    • Brute
    • C2
    • Compromised
    • Crypto
    • Data Leakage
    • DDOS
    • Dynamic DNS
    • Exfil
    • Exploit
    • Fraud
    • Hacking Tool
    • I2P
    • Informational
    • Malware
    • P2P
    • Parked
    • Phish
    • Scan
    • Sinkhole
    • Social
    • Spam
    • Suppress
    • Suspicious
    • TOR
    • VPS
    Yes
    Specify the threat type for the observables.
    Source
    String
    Siemplify
    No
    Specify the intelligence source for the observable.
    Expiration Date
    Integer
    N/A
    No
    Specify the expiration date in days for the observable. If nothing is specified here, action will create an observable that will never expire.
    Trusted Circle IDs
    CSV
    N/A
    No
    Specify the comma-separated list of trusted circle ids. Observables will be shared with those trusted circles.
    TLP
    DDL

    Select One

    Possible Values:

    • Select One
    • Red
    • Green
    • Amber
    • White
    No
    Specify the TLP for your observables.
    Confidence
    Integer
    N/A
    No
    Specify what should be the confidence for the observable. Note: This parameter will only work, if you create observables in your organization and requires Override System Confidence to be enabled.
    Override System Confidence
    Checkbox
    Unchecked
    No
    If enabled, created observables will have the confidence specified in the Confidence parameter. Note: You can't share observables in trusted circles and publicly, when this parameter is enabled.
    Anonymous Submission
    Checkbox
    Unchecked
    No
    If enabled, action will make an anonymous submission.
    Tags
    CSV
    N/A
    No
    Specify a comma-separated list of tags that you want to add to observable.

    Run on

    This action runs on the following entities:

    • Hash
    • IP Address
    • URL
    • Email

    Action results

    Script result
    Script result name Value options Example
    is_success
    		 True or False is_success:False
    JSON result
      approved_jobs 
  
 = 
  
 [ 
  
 { 
  
 "id" 
 :, 
  
 "entity" 
 : 
  
 { 
 e 
 nt 
 i 
 t 
 y.ide 
 nt 
 i 
 f 
 ier 
 } 
  
 } 
 ] 
  
 jobs_wi 
 t 
 h_excluded_e 
 nt 
 i 
 t 
 ies 
  
 = 
  
 [ 
  
 { 
  
 "id" 
 :, 
  
 "entity" 
 : 
  
 { 
 e 
 nt 
 i 
 t 
 y.ide 
 nt 
 i 
 f 
 ier 
 } 
  
 } 
 ]
    Case wall
    Result type Description Type
    Output message*

    The action should not fail nor stop a playbook execution:

    If successful and at least one hash across entities is found(is_success=true): "Successfully submitted and approved the following entities in Anomali ThreatStream:\n{0}".format(entity.identifier list)

    If fails to enrich some entities (rejected entities) (is_success=true): "Action was not able to successfully submit and approve the following entities in Anomali ThreatStream\n: {0}".format([entity.identifier])

    If fails to enrich for all entities (is_success=false): "No entities were successfully submitted to Anomali ThreatStream."

    The action should fail and stop a playbook execution:

    If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Submit Observables". Reason: {0}''.format(error.Stacktrace)

    If the 400 status code is reported: "Error executing action "Submit Observables". Reason: {0}''.format(message)

    		 General

    Link:

    https://siemplify.threatstream.com/import/review/{jobid}

    		Entity

    Connectors

    For more detail about how to configure connectors in Google SecOps, see Ingest your data (connectors) .

    Anomali ThreatStream - Observables Connector

    Pull observables from Anomali ThreatStream.

    Source names are used in the dynamic list.

    To find the ID of a trusted circle, locate the trusted circle on Anomali ThreatStream, and click its name. The URL displayed in the address bar shows the ID, such as https://siemplify.threatstream.com/search?trustedcircles=13 .

    Connector parameters

    Use the following parameters to configure the connector:

    Parameter name
    Type
    Default value
    Is mandatory
    Description
    Product Field Name
    String
    Product Name
    Yes

    The name of the field where the product name is stored.

    The default value is Product Name .

    The product name primarily impacts mapping. To streamline and improve the mapping process for the connector, the default value resolves to a fallback value that is referenced from the code. Any invalid input for this parameter resolves to a fallback value by default.

    Event Field Name
    String
    type
    Yes

    The name of the field that determines the event name (subtype).

    Environment Field Name
    String
    ""
    No

    The name of the field where the environment name is stored.

    If the environment field is missing, the connector uses the default value.

    Environment Regex Pattern
    String
    .*
    No

    A regular expression pattern to run on the value found in the Environment Field Name field. This parameter lets you manipulate the environment field using the regular expression logic.

    Use the default value .* to retrieve the required raw Environment Field Name value.

    If the regular expression pattern is null or empty, or the environment value is null, the final environment result is the default environment.

    Script Timeout (Seconds)
    Integer
    300
    Yes
    Timeout limit for the python process running the current script.
    API Root
    String
    https://api.threatstream.com
    Yes
    API root of the Anomali ThreatStream instance.
    Email Address
    String
    N/A
    Yes
    Email address of the Anomali ThreatStream account.
    API Key
    Password
    N/A
    Yes
    API Key of the Anomali ThreatStream account.
    Lowest Severity To Fetch
    String
    High
    Yes

    Lowest severity that will be used to fetch observables.

    Possible values:

    • Low
    • Medium
    • High
    • Very-High
    Lowest Confidence To Fetch
    Integer
    50
    Yes
    Lowest confidence that will be used to fetch observables. The maximum is 100 .
    Source Feed Filter
    CSV
    N/A
    No
    Comma-separated list of feed IDs that should be used to ingest observables, such as 515,4129 .
    Observable Type Filter
    CSV
    URL, domain, email, hash, ip, ipv6
    No

    Comma-separated list of observable types that should be ingested, such as URL, domain .

    Possible values: URL , domain , email , hash , ip , ipv6

    Observable Status Filter
    CSV
    active
    No

    Comma-separated list of observable status that should be used to ingest new data, such as active,inactive

    Possible values: active , inactive , falsepos

    .
    Threat Type Filter
    CSV
    N/A
    No

    Comma-separated list of threat types that should be used to ingest observables, such as adware,anomalous,anonymization,apt .

    Possible values: adware , anomalous , anonymization , apt , bot , brute , c2 , compromised , crypto , data_leakage , ddos , dyn_dns , exfil , exploit , fraud , hack_tool , i2p , informational , malware , p2p , parked , phish , scan , sinkhole , spam , suppress , suspicious , tor , vps

    Trusted Circle Filter
    CSV
    N/A
    No

    Comma-separated list of trusted circle ids that should be used to ingest observables, such as 146,147 .

    Tag Name Filter
    CSV
    N/A
    No
    Comma-separated list of tag names associated with observables that should be sed with ingestion, such as Microsoft Credentials, Phishing .
    Source Feed Grouping
    Checkbox
    Unchecked
    No
    If enabled, the connector groups observables from the same source under the same Google SecOps alert.
    Fetch Max Days Backwards
    Integer
    1
    No

    The number of days prior to today to retrieve the observables.

    This parameter can apply to the initial connector iteration after you enable the connector for the first time, or the fallback value for an expired connector timestamp.

    Max Observables Per Alert
    Integer
    100
    No
    The number of observables to include in a Google SecOps alert. The maximum allowed is 200.
    Use whitelist as a blacklist
    Checkbox
    Unchecked
    Yes

    If selected, the connector uses the dynamic list as a blocklist.

    Verify SSL
    Checkbox
    Unchecked
    Yes
    If selected, the integration validates the SSL certificate when connecting to the Anomali ThreatStream server.
    Proxy Server Address
    String
    N/A
    No
    The address of the proxy server to use.
    Proxy Username
    String
    N/A
    No
    The proxy username to authenticate with.
    Proxy Password
    Password
    N/A
    No
    The proxy password to authenticate with.

    Connector rules

    The connector supports proxies.

    Need more help? Get answers from Community members and Google SecOps professionals.

    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: