Threatconnect

---
name: threatconnect
description: "Expert agent for ThreatConnect TIP and SOAR platform. Covers CAL scoring, ThreatConnect Intelligence feeds, visual playbook automation, case management, indicator management, groups and associations, and STIX/TAXII integration. WHEN: \"ThreatConnect\", \"TC\", \"CAL\", \"Collective Analytics Layer\", \"TCI\", \"ThreatConnect Intelligence\", \"TC playbooks\", \"TC case management\", \"Dataminr\"."
license: MIT
---

# ThreatConnect

This skill covers ThreatConnect's Threat Intelligence Platform (TIP) and SOAR capabilities. It has expertise in ThreatConnect's data model, CAL scoring, playbook automation, and operational workflows.

**Context:** ThreatConnect was acquired by Dataminr in 2024. The platform continues to operate under the ThreatConnect brand. Dataminr brings additional real-time event and social media intelligence capabilities to the combined offering.

## How to Approach Tasks

1. **Classify the request type:**
   - **Intelligence management** -- Indicator lifecycle, groups, tagging, scoring
   - **Playbook automation** -- Visual playbook design, triggers, actions
   - **Case management** -- Incident tracking, tasks, analyst workflow
   - **Integration** -- SIEM, SOAR, EDR, and API integration
   - **Feeds / sharing** -- TCI feeds, TAXII, ISAC sharing

2. **Identify deployment model:**
   - **ThreatConnect Cloud** (SaaS, recommended for new deployments)
   - **ThreatConnect On-Premises** (self-hosted)
   - **Hybrid** (on-prem + cloud storage)

3. **Clarify edition** -- ThreatConnect offers tiered editions with different feature sets.

## Platform Overview

ThreatConnect combines Threat Intelligence Platform (TIP) + SOAR in a single product. This is a key differentiator: most organizations must buy and integrate separate TIP and SOAR tools.

**Core capabilities:**
- **TIP**: Store, enrich, score, and share threat intelligence
- **SOAR**: Automate response workflows and orchestrate security tools
- **Case Management**: Track incidents and investigations
- **Collaboration**: Share intelligence within ThreatConnect community or with specific partners

## ThreatConnect Data Model

### Intelligence Types

ThreatConnect organizes intelligence into **Indicators** and **Groups**.

**Indicators** (atomic observables):
- Address (IP address)
- EmailAddress
- File (hash: MD5, SHA-1, SHA-256)
- Host (domain/hostname)
- URL
- ASN
- CIDR
- Mutex
- Registry Key
- User Agent

**Groups** (containers for intelligence):
- **Threat**: Threat actor or campaign
- **Adversary**: Named adversary profile
- **Campaign**: Set of related activities
- **Incident**: Specific breach or event
- **Report**: Intelligence report artifact
- **Signature**: Detection rule (Snort, YARA, Sigma)
- **Attack Pattern**: MITRE ATT&CK technique
- **Malware**: Malware family
- **Course of Action**: Defensive recommendation
- **Vulnerability**: CVE or software vulnerability
- **Task**: Action item for an analyst

**Associations**: Any indicator or group can be associated with any other (linked with relationship type).

### Tags and Attributes

**Tags:** Flexible labeling for classification and filtering
- ATT&CK technique tags (T1566, T1059, etc.)
- TLP tags (TLP:RED, TLP:AMBER)
- Custom organizational tags

**Attributes:** Structured metadata fields
- Description (human-readable explanation)
- Source (where did this intelligence come from?)
- Confidence (0-100)
- Expiration date (when should this be retired?)
- Custom attributes (organization-defined fields)

## Collective Analytics Layer (CAL)

CAL is ThreatConnect's ML-based scoring engine that aggregates activity data from across the ThreatConnect community.

### How CAL Works

1. ThreatConnect community members observe indicators (IPs, domains, hashes) in their environments
2. Members report sightings to ThreatConnect (anonymized)
3. CAL aggregates sightings across all community members
4. ML model scores each indicator based on:
   - Sighting frequency (how many customers have seen it?)
   - Sighting recency (recent sightings weight higher)
   - Sighting context (was it observed in attack traffic vs. benign traffic?)
   - Association context (what threat actors or malware families is it linked to?)

### CAL Score

- Score range: 0-1000 (or displayed as percentage in some UI versions)
- Higher score = more community evidence of malicious activity
- Displayed alongside analyst-assigned confidence score

**Comparison to Recorded Future Risk Score:**
- RF: Based on open web/dark web intelligence + Collective Insights
- CAL: Primarily community telemetry from ThreatConnect customer base (sighting data)
- Both provide complementary signals; organizations with both tools can combine scores

### CAL Integration in Workflow

CAL scores surface in:
- Indicator detail view (CAL score displayed prominently)
- Playbook enrichment (CAL enrichment action adds score to case data)
- API response (`/v3/indicators/{id}` returns `calScore` field)

## Indicator Lifecycle Management

### Adding Indicators

**Manual:**
- `Intelligence > Indicators > Create`
- Select type, enter value, add tags/attributes

**Bulk import:**
- CSV upload with field mapping
- STIX/TAXII import (TAXII 2.1 consumer built-in)
- API: `POST /v3/indicators`

**From feeds (TCI):**
- Subscribe to ThreatConnect Intelligence (TCI) feeds
- Indicators automatically ingested and scored on schedule

### Indicator Rating

ThreatConnect uses a 0-5 rating scale (distinct from score):
- 0: Unknown
- 1: Suspicious
- 2: Suspicious
- 3: Moderate
- 4: Malicious
- 5: Confirmed Malicious

Rating is analyst-assigned (human judgment). Score (CAL) is algorithmic. Use rating for manual analysis; score for automated workflows.

### Indicator Expiration

All indicators should have an expiration date:
- IP addresses: 30-90 days (frequently recycled infrastructure)
- Domains: 90-180 days
- File hashes: 1-3 years (malware artifacts are more durable)
- YARA rules: 1-2 years

ThreatConnect can automatically retire expired indicators (move to inactive status). Configure in organization settings.

## ThreatConnect Intelligence (TCI)

TCI is ThreatConnect's commercial threat feed offering.

**Feed categories:**
- Malware campaign indicators (IPs, domains, hashes for active campaigns)
- Phishing infrastructure
- Botnet C2
- Ransomware actor infrastructure
- CVE exploitation data
- Dark web intelligence (credentials, targeting information)

**TCI vs. community feeds:**
- TCI: Commercial, curated, higher confidence, SLA-backed
- Community: Free, crowdsourced, variable quality

**Configuring TCI feeds:**
`Intelligence > Sources > ThreatConnect Intelligence`
- Select feed types relevant to your environment
- Set auto-tagging (automatically tag indicators from specific feeds)
- Configure auto-rating (set default rating for indicators from each feed source)

## Playbooks (SOAR)

ThreatConnect's visual playbook builder enables no-code/low-code automation.

### Playbook Architecture

**Triggers:**
- **Trigger Timer**: Run on schedule (every hour, daily, weekly)
- **Trigger HTTP Link**: Webhook trigger (external system calls TC)
- **Trigger Case Created/Updated**: Fires when TC case event occurs
- **Trigger Indicator Added/Updated**: Fires when indicator event occurs
- **User Action Trigger**: Manual trigger from analyst (button in UI)

**Actions (Apps):**
ThreatConnect has a marketplace of pre-built apps:
- TC apps: Create indicator, create case, add tag, send notification
- Vendor apps: Splunk, Sentinel, CrowdStrike, Palo Alto, VirusTotal, MISP, Slack, Jira, etc.
- Custom apps: Python-based custom apps deployable to TC

**Operators:**
- Conditional (if/then/else): Branch based on data values
- Loop: Iterate over list of items
- Merge: Combine parallel branches
- Sleep: Delay execution
- Set Variable: Define or transform data values

### Example Playbook: IOC Enrichment + SIEM Push

```
Trigger: Indicator Added (type = Address, CAL score > 70)
  ↓
Action: Get Indicator Details [TC built-in]
  ↓
Action: VirusTotal IP Lookup [VT app]
  ↓
Conditional: VT malicious count > 5?
  → Yes: Set indicator Rating = 4
  → No: Set indicator Rating = 2
  ↓
Action: Splunk Create Notable Event [Splunk app]
  ↓
Action: Send Slack Notification [Slack app]
  └── "New high-confidence IOC added: {indicator.value}, CAL: {indicator.calScore}"
```

### Example Playbook: Phishing Triage

```
Trigger: HTTP Link (from email gateway webhook on suspicious email)
  ↓
Action: Extract IOCs from email headers (from/reply-to, URLs, attachments)
  ↓
Loop: For each extracted URL
  ├── TC Indicator Lookup: Does URL exist in TC?
  ├── URLScan.io scan: Submit URL, get screenshot + verdict
  ├── Conditional: URL malicious?
  │   → Yes: Add to TC as malicious URL indicator; quarantine email
  │   → No: Continue
  ↓
Action: Create TC Case with enriched findings
  ↓
Action: Assign case to analyst (or auto-close if all benign)
```

### Playbook Deployment

Playbooks can be:
- Active: Running in production
- Inactive: Disabled (no executions)
- Debug: Executions logged with full trace for troubleshooting

**Version control:** ThreatConnect maintains playbook version history. Roll back to previous version if an update breaks something.

## Case Management

ThreatConnect's case management is the analyst workflow layer.

### Case Structure

- **Case**: Top-level container for an investigation or incident
- **Tasks**: Sub-items for tracking actions within a case
- **Artifacts**: IOCs, files, evidence attached to a case
- **Notes**: Analyst commentary and findings
- **Workflow**: Structured task sequence (like a runbook executed per case)
- **Associations**: Link case to indicators, groups, other cases

### Workflows (Case Templates)

Pre-define standard operating procedures as TC workflows:
- Phishing triage workflow: [Review email headers] → [Check IOCs] → [Sandbox attachment] → [Notify user] → [Close or escalate]
- Ransomware incident workflow: [Isolate systems] → [Identify restore point] → [Engage IR] → [Document] → [Remediate]

When a case is created, assign a workflow and TC creates all tasks automatically.

### Case Metrics

`Analytics > Cases` dashboard shows:
- Open cases by priority
- Case age distribution
- Analyst workload (cases assigned per analyst)
- MTTD/MTTR trend (mean time to detect/respond)

## SIEM/SOAR Integration Architecture

### Splunk Integration

**Option 1: TC as enrichment for Splunk SIEM**
- Splunk queries TC API for indicator enrichment
- TC Splunk app provides `tclookup` search command
- Usage: `| tclookup src_ip AS ip TYPE indicators | table ip, rating, calScore, tags`

**Option 2: TC playbook triggered by Splunk webhook**
- Splunk Alert Action → HTTP POST to TC playbook trigger
- TC playbook enriches, scores, and creates a case
- Case linked back to Splunk alert

### Microsoft Sentinel Integration

- TC TAXII server → Sentinel Threat Intelligence Indicators table
- Logic App for bidirectional: Sentinel incident → TC case creation
- TC indicators consumed via TAXII 2.1 collector

### CrowdStrike Falcon Integration

- TC IOCs pushed to CrowdStrike custom IOC store
- CrowdStrike detections trigger TC case creation (via webhook)
- Bidirectional: Falcon detection → TC case → TC enrichment → Block decision → Falcon custom IOC update

## API Reference

### API v3 (Current)

Base URL: `https://{instance}.threatconnect.com/api/v3`

**Authentication:** HMAC-based signature (API ID + secret key)

**Key endpoints:**
```
GET /indicators  -- List all indicators (filterable)
POST /indicators  -- Create indicator
GET /indicators/{id}  -- Get indicator detail with CAL score
PUT /indicators/{id}  -- Update indicator
DELETE /indicators/{id}  -- Delete indicator

GET /groups  -- List all groups
POST /groups  -- Create group (threat, campaign, incident, etc.)
GET /groups/{id}/indicators  -- Indicators associated with group

GET /cases  -- List cases
POST /cases  -- Create case
POST /cases/{id}/tasks  -- Add task to case
POST /cases/{id}/artifacts  -- Add artifact to case

GET /playbooks  -- List playbooks
POST /playbooks/{id}/trigger  -- Trigger playbook manually
```

**Filtering:**
```
GET /indicators?tql=rating >= 4 AND calScore >= 700 AND type = "Address"
```

TQL (ThreatConnect Query Language) supports rich filtering on any field.

### STIX/TAXII

**TAXII 2.1 Server:**
ThreatConnect exposes all intelligence as STIX 2.1 via TAXII:
- Discovery: `https://{instance}.threatconnect.com/taxii2/`
- Export collections: Indicators, Groups (by type), or custom filtered exports

**TAXII 2.1 Client (Consumer):**
ThreatConnect can consume STIX from any TAXII source:
`Intel Sources > Add Source > TAXII 2.1`
- Configure source URL, credentials
- Set polling interval and target collection
- Auto-tag indicators from this source

## Dataminr Integration

Following the 2024 acquisition, Dataminr's real-time event intelligence supplements ThreatConnect:

**Dataminr capabilities:**
- Real-time alerts from social media, news, and other public signals
- Natural disaster, civil unrest, cyber event early warning
- Critical event detection before traditional media picks it up

**Integration with ThreatConnect:**
- Dataminr alerts that are cyber-relevant (data breach news, vulnerability disclosure, infrastructure attacks) can flow into ThreatConnect
- Creates a source feed in TC for Dataminr alerts
- Playbooks can trigger on Dataminr alerts (e.g., "Critical vulnerability disclosed for technology in our stack → create TC task for patch assessment")