Learn & Share

Current StateCurrently, the ThreatQ user interface does not allow users to create new Indicator Types.While users can create ad-hoc types for other objects such as Events or Attachments, defining new Indicator Types currently requires the ThreatQ API. Some users have leveraged this API to create types such as:    •    Routing Number    •    Bitcoin Address    •    Account Number    •    Phone NumberAlternatively, it’s possible to achieve similar outcomes with Custom Objects, though those typically require more configuration and are not as seamlessly integrated across the platform.We’d like to better understand what would be most useful to you:    •    How important is it for your team to create new Indicator Types through the UI?    •    What kinds of custom indicators do you need to track most often?    •    How would you expect to manage these custom types (na

Current State Currently, when creating a new object in ThreatQ using the Create Object modal, users can set a limited set of fields: Value Type Status Source (and, for some object types, a description) The APIs already allow additional details — such as Tags and Attributes — to be added when creating objects. However, these options aren’t currently available in the UI, which means users often have to go back and edit the object later to add context. We’d like to hear how expanding the Create Object modal could improve your workflows: What extra fields or context would be most helpful to capture at creation time? Would being able to add Tags,

Currently, ThreatQ does not display UI notifications or alerts when a newer version of an installed integration is available in the Marketplace. Users need to manually check for updates and then download and upload the new integration files to update their environment.We’re exploring how to make this experience more seamless and would love your input: How would you like to be notified that an integration is out of date — a badge, alert, or status message? Would you prefer to see version information (installed vs. latest) directly on the Integrations page? How useful would a one-click “Update” option be for your workflows? Would automated or scheduled updates fit into your organization’s change control process? Your feedback will help us understand what kind of update visibil

When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being flagged by security tools, since they may contain data that appears malicious.However, some organizations (such as financial institutions) have strict security policies that prohibit downloading password-protected files, since they can’t be inspected by endpoint protection tools. This can make troubleshooting feeds more difficult.We’d like to better understand how you’d prefer to handle this scenario: Would you want the option to toggle password protection for Feed Run files directly from the UI? Would it be more useful to view the file contents securely in-platform,

Following from our announcement re DPM Flex Consumption, our mechanism to all our customers to optimize their data ingestion for effectiveness, efficiency and efficacy - here’s a sneak preview of the billing dashboard that is expected to ship in the December platform update.  You’ll be able to see both total consumption in absolute GB/d, and also billed consumption in terms of the weighted “cost” of each pipeline, giving you visibility of how your DPM effectiveness changes over time and plenty of warning if you are approaching your committed limit.  More information to come and always happy to answer questions.   

For all our customers who participated in the Search Agent Early Access that ends Dec 31 2025 -  I’d like to extend my sincere thanks for your participation in the Search Agent Early Adopter Program over the past ten months. Your engagement and thoughtful feedback have been instrumental in shaping this capability - helping us deliver three progressive releases, the most recent in September R1 2025.Your input has driven tangible improvements in accuracy, performance, and user experience, transforming the original concept into a robust and intuitive feature.As we prepare to close the Early Adopter phase in December 2025 and transition Search Agent to general availability, we’d greatly value your final feedback to help us fine-tune the GA experience.Please take a few minutes to share your perspective by answering the brief questions below - we are happy to talk through your experience if you’d rather discuss: Does your team

Almost all Securonix SIEM customers are now enabled for Security Alert Center, and with it (as long as you have approved AI components) the Response Agent - have you tried it yet? Any feedback welcome. We estimate it averages about 20min time saved per violation - do you agree?   

You can find the tile to access TQ Marketplace on the main page. Or use this link: https://marketplace.threatq.com/

Why Network Visibility MattersMany security teams rely on Proxy and Web Application Firewall (WAF) logs for visibility, but that’s only part of the picture.🛡️ Firewalls, especially their allowed traffic logs, reveal critical activity that other tools can’t see.🔍 They’re essential for detecting, investigating, and preventing threats across the entire attack lifecycle, from the first probe to the final exfiltration attempt. ✨ Where to StartTo unlock this visibility and close detection gaps, focus on the following six best practices.We’ll begin with the foundation: capturing Layer 3/4 network visibility. 🌐 1. Capture Layer 3/4 Network Visibility