Recently active topics

 Audience: SOC Analysts, Threat Intelligence Analysts, Security Operations LeadersProduct Module:Threat Intelligence Management (ThreatQ Platform)Last Updated: December 18, 2025KB ID: KB‑20251218‑ThreatQ‑Scoring‑ExpirationTags: Threat Intelligence, Lifecycle Management, Scoring, Expiration, Indicator Management, ThreatQ, SOC OperationsProblemOrganizations often ingest large volumes of threat intelligence but still experience security gaps, alert fatigue, and false positives. Without a way to prioritize and retire data, threat intelligence becomes noisy instead of actionable.ObjectiveHelp security teams understand how scoring and expiration can be used to manage the full threat intelligence lifecycle—from ingestion to retirement—so analysts can focus on intelligence that is relevant, timely, and aligned with business risk.Step‑by‑Step Solution1. Birth: Choose the Right IntelligenceEffective threat intelligence starts with careful source selection. Ingesting every available feed often in

 Grouping in Securonix is a two-fold process: Create Data Sources (DS) correctly — Syslog and API logs must be separated into their own DS so that grouping is clean and meaningful. Use functionality and Spotter searches — Once DS are created properly, Securonix automatically groups the logs and allows you to search, drill down, and correlate them easily. Both steps together form the basis of how grouping works end-to-end. Creating Data Sources Correctly (Foundation of Grouping) A. Syslog When onboarding syslog data, for example Palo Alto firewall data, we can use separate Data Sources to maintain zone-based segmentation such as Trust, Untrust, DMZ.Example using different ports:Palo_Untrust → TCP 514 Palo_Trust → TCP 515If using multiple ports is not an option, we can use Syslog filters to split the data into unique Data Sources, even when all logs arrive on a single port such as TCP 514. Filters can be based on hostname, IP range, or message patterns. This maintains zone-based segmen

During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?

 🧠 OverviewWe’re thrilled to announce the release of the VMRay Action for the ThreatQuotient TDR Orchestrator!This new integration allows you to submit URL-based data collections directly to the VMRay Malware Analysis Platform for dynamic analysis and enrichment. By automating the submission of indicators of compromise (IOCs) to VMRay, analysts can enhance detection accuracy and streamline threat investigation workflows.⚙️ Key CapabilitiesThe integration introduces a new TDR Orchestrator Action:VMRay – Submit IOCs – Exports IOCs (specifically URL objects) from ThreatQ to the VMRay platform for automated analysis and enrichment.Once submitted, VMRay returns enriched URL-type indicators that can include:Verdicts (e.g., malicious, suspicious, benign) IOC metadata YARA rule matches Behavioral and network indicators Malicious file hashes Detonation reports (PDF format)🔌 VMRay Operation Connection CapabilitiesThe VMRay Operation enables direct connection from ThreatQ into the VMRay Analyze

ProblemSecurity teams often need to push indicators of compromise (IOCs) into DNS-layer security solutions like Infoblox Threat Defense. Without automation, uploading and maintaining threat lists becomes manual, slow, and error-prone — limiting an organization’s ability to respond rapidly to emerging threats.ObjectiveThis article explains how the Infoblox Threat Defense Action integrates with ThreatQuotient TDR Orchestrator (TQO) to automate IOC uploads and deletions in Infoblox custom lists. It also summarizes configuration considerations and supported indicator types.OverviewReleased on March 26, 2025, the Infoblox Threat Defense Action allows ThreatQuotient users to upload or delete indicators from a custom list inside the Infoblox Threat Defense Cloud platform.This action provides a streamlined, automated mechanism for updating DNS-layer defenses with the latest threat intelligence. By connecting ThreatQ directly to Infoblox, analysts can rapidly enrich detections and synchronize b

ProblemSecurity teams often manage threat intelligence in ThreatQuotient while handling incident response and remediation in ServiceNow — this can create silos, manual hand-offs, and delays in triage and response.ObjectiveThis article explains how the ServiceNow Action Bundle for ThreatQuotient enables seamless synchronization between ThreatQ and ServiceNow — automating ticket creation, observable tracking, and incident synchronization to streamline workflows across intelligence and ITSM.OverviewWith the ServiceNow Action Bundle (released June 27, 2024), ThreatQuotient users can create and sync ServiceNow tickets and observables directly from ThreatQ. This ensures that indicators, incidents, and other ThreatQ objects have matching records in ServiceNow — bridging threat intelligence and operational response workflows.For each indicator in ThreatQ, an observable is created in ServiceNow and automatically linked to the corresponding ticket. Non-indicator ThreatQ objects (e.g., assets, ma

ProblemSecurity teams often lack unified visibility across external threats, leaked credentials, asset exposures, and vulnerability intelligence. Without automated ingestion, correlating SOCRadar findings with ThreatQuotient data becomes manual and inefficient.ObjectiveThis article explains how the SOCRadar CDF integration works, what data it ingests, and how to install and configure it in ThreatQuotient to enhance investigations and threat-centric workflows.OverviewThe SOCRadar CDF (Custom Data Feed) integration enables ThreatQuotient users to pull enriched threat intelligence and risk data directly from their SOCRadar tenant. As announced in the product update, the integration ingests intelligence covering threats, leaked credentials, alarms, and asset-related vulnerabilities.SOCRadar is an Extended Threat Intelligence (XTI) platform that combines: Cyber Threat Intelligence (CTI) External Attack Surface Management (EASM) Digital Risk Protection (DRP) By connecting SOCRadar and Th

ProblemAnalysts investigating Domain and URL-based threats need up-to-date intelligence for effective triage. Without automated enrichment, threat data can become outdated, requiring manual look-ups that slow response and increase risk of oversight.ObjectiveThis article details how the alphaMountain CDF integration works — what it provides, how to install and configure it, and how it behaves — so that administrators and analysts can quickly enable and benefit from automated Domain/URL enrichment.OverviewThe alphaMountain CDF enables automatic ingestion of Domain and URL intelligence (categorizations and threat scores) into your platform. Using AI and machine learning, alphaMountain provides fast, contextual insight about Domains and URLs — delivering timely threat-relevant information to support investigations and threat hunting. helpcenter.threatq.comThe integration offers two distinct feeds: “Threat Categorizations” and “Threat Scores,” delivering updated categorization data or risk

ThreatQ provides a comprehensive REST API documentation and an extensive Swagger collection, making it easy to explore available endpoints and parameters. However, we’ve heard that developers and analysts could benefit from use-case–based documentation — examples that walk through common workflows and best practices for interacting with the API.This type of documentation could help: Understand best practices for using the API effectively Avoid inefficient or unsupported methods for common operations Get started faster with real-world, task-based examples We’d like your input on what would be most helpful: What API use cases do you find yourself repeating or struggling to document? Would you prefer Python examples or other scripting languages? How detailed should examples be (step-by-step, or just reference snippets)? Which topics should be prioritized — e.g.:   Uploading attachments via the API and parsing content for IOCs Bulk searching IOCs using Threat Library filte

Securonix Threat Research (STR) Monthly Newsletter– November 2025 Edition – Welcome back to another newsletter by the Securonix Threat Research Team!November has been a month of a LOT of reverse engineering. The team has been grabbing malware samples from multiple sources to find novel and interesting techniques and indicators to share with the community. Our team has also been featured and seen this month during the FS-ISAC EMEA webinar where Shikha Sangwan presented her findings for CHAMELEON#NET. We provided commentary on the latest Kimsuky & Lazarus Tooling, Evolving ClickFix Attacks, the recent Government Compromise, CISA 2015 Reauthorization, Chinese using Claude to “AutoAttack”,  XWiki CVE-2025-24893, and Legacy Firewall Attacks. We also now have Securonix Connect to share these ideas and updates in a more streamlined way! Oftentimes, news outlets summarize a lot of our commentary but now we have a place in the Connect to share our thoughts and interact with anyone who has f