Securonix Connect!

Recent activity
Help others
Categories

Target Audience: ThreatQ Administrators, Threat Intelligence Analysts, SOC AnalystsProduct Module: Threat Library > Indicator ParserLast Updated: July 15, 2026Tags: ThreatQ, Indicator Parser, IOC Import, Threat Library, CSV Import, REST API, Event

170

3 days ago

MikiNew Participant

Use Cases

Normalization of Risk Score Should Be Standard Across Integrations

We would like to see the normalization of risk scores. This is essential for easy of use within the indicator scoring policy. We have came across this issue with Domain Tools, AbuseIPDB, and AlienVault. Reference the Google Threat Intelligence CDF is

100

3 days ago

zach.shames.sxEmployee

Use Cases

ThreatQ: Excel File Parsing

Hi Community, ThreatQ currently has the ability to parse PDFs, CSVs, and other plain text files for IOCs. How useful would it be to add support for parsing Excel files? Here are some additional questions that will help us understand how you may use T

981

3 days ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

Securonix ThreatWatch Monthly Intelligence Insights – July 2026

Securonix ThreatWatch Monthly Intelligence Insights – July 2026 Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar Introduction: The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by

220

4 days ago

slakshmiCommunity Manager

How-To Guides

Restart Dynamo Pods to Restore Threat Intelligence Feed Processing

Audience: Administrators, MSSPsProduct Module: Threat Intelligence (ThreatQ) > Dynamo Feed ProcessingLast Updated: July 17, 2026KB ID: KB-20260717-dynamo-pod-restartTags: ThreatQ, Threat Intelligence, Dynamo, Feed Processing, Kubernetes, Redis, S

100

5 days ago

kramanathanCommunity Manager

Coming Soon: Group-Based Tenant Access

Many of you who manage multiple tenants in Securonix have consistently provided valuable feedback on a recurring challenge: assigning tenant access one user at a time does not scale.Every new tenant requires administrators to revisit each analyst who

190

6 days ago

slakshmiCommunity Manager

Tips & Tricks

AI / LLM Settings Page Is Missing in ThreatQ (Threat Research Agent)

Audience: ThreatQ Administrators, Support Engineers, Hosted Operations EngineersProduct Module: ThreatQ → System Configurations → AI (Threat Research Agent)Last Updated: August 5, 2026KB ID: KB-20260805-ai-llm-settings-missingTags: ThreatQ, Threat Re

120

10 days ago

slakshmiCommunity Manager

Introducing ThreatWatch: Modernized Threat Exposure Validation

Audience: Security Administrators, Security Analysts, SOC Teams, MSSPsProduct Module: ThreatWatch / ThreatQLast Updated: July 3, 2026Article Type: Product UpdateTags: ThreatWatch, ThreatQ, Autonomous Threat Sweeper, ATS, Threat Hunting, Threat Intel

340

11 days ago

kramanathanCommunity Manager

Product Update: New Value Package - Threat Detection for AI

New Securonix Value Package: Threat Detection for AIWe are pleased to announce the availability of the Securonix Threat Detection for AI Value Package.This release currently provides 43 out-of-the-box policies under the label scx.vp.AI, giving securi

590

16 days ago

kramanathanCommunity Manager

Product Update: Email Notifications When Ingestion Approaches Licensed Capacity

We have added email notifications for approaching overages so you can stay ahead of them rather than discovering them later in the invoice cycle. This feature is available in 6.4 April R1 and later.It is designed for platform administrators, MSSP adm

320

17 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1300

1 month ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

760

2 months ago

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1621

3 months ago

martel.williamsNew Member

Use Cases

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

680

3 months ago

makayla.smithNew Member

Use Cases

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

4922

3 months ago

martel.williamsNew Member

Show & Tell

Cloudflare WAF logs are not showing in the platform

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

2862

3 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2782

4 months ago

martel.williamsNew Member

Use Cases

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

4181

4 months ago

BrillNew Participant

Use Cases

How can I display amalgamated vulnerability intelligence on a dashboard?

I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d

2231

4 months ago

Ak_098New Member

Tips & Tricks

IOC Enrichment Malware Attribution Gaps and Alternative Approaches

Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to

2021

6 months ago