ThreatConnect
Overview
Supported Actions Version 3.0.2
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 3.0.1
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 3.0.0
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 2.2.7
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 2.2.6
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 2.2.5
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 2.2.3
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Supported Actions Version 2.1.3
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity
- list owners: List the owners visible with the configured credentials
- post data: Create an indicator and post it to ThreatConnect
- hunt ip: Hunt an IP and retrieve any available information
- hunt file: Hunt a file hash and retrieve available information
- hunt email: Hunt an email and retrieve available information
- hunt domain: Hunt a domain and retrieve available information
- hunt url: Hunt a URL and retrieve available information
Release Notes
Version 3.0.2
- Resolved app issues related to Python 3.13 upgrade
- updated dependencies for python 3.13
Version 3.0.1
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 3.0.0
Unreleased * Moved API support from V2 to V3 * Action hunt ip gained 3 new boolean parameters controlling which data is retrieved for Indicators: attribute, tag, and security label * Action hunt file gained 3 new boolean parameters controlling which data is retrieved for Indicators: attribute, tag, and security label * Action hunt email gained 3 new boolean parameters controlling which data is retrieved for Indicators: attribute, tag, and security label * Action hunt domain gained 3 new boolean parameters controlling which data is retrieved for Indicators: attribute, tag, and security label * Action hunt url gained 3 new boolean parameters controlling which data is retrieved for Indicators: attribute, tag, and security label * As a result, the output data paths have been updated. To ensure your existing playbooks function correctly, please update, reinsert, modify, or delete the affected action blocks accordingly.
Version 2.2.7
- Removed django and requests dependencies in order to use platform packages [PAPP-31087, PAPP-31082, PAPP-31096, PAPP-30822]
Version 2.2.6
- Update Django module per [CVE-2022-28347] [CVE-2022-36359] - [PAPP-30335]
Version 2.2.5
ThreatConnect Release Notes - Published by Splunk February 04, 2022
Version 2.2.5 - Released February 04, 2022
- Marked the app as FIPS Compliant [PAPP-21696]
- Added support for Python 3.9
Version 2.2.3
ThreatConnect Release Notes - Published by Splunk November 17, 2021
Version 2.2.3 - Released November 17, 2021
- Added the Fields into post data action [PAPP-4815]
Version 2.1.3
ThreatConnect Release Notes - Published by Splunk August 16, 2021
Version 2.1.3 - Released August 16, 2021
- Minor bug fix in schedule poll [PAPP-17216]