Tips & Tricks

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually.  While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this incident, build a Diamond Model. Identify the Adversary, Infrastructure, Capability, and Victim — and map any observed TTPs to each vertex. And you will get back a comprehensive report like below - you can of course fine tune your prompt for verbosity and content.  What are your favorite SAM questions? Please share!  

Did you know SAM can map a violation against MITRE? Simply ask: Map every alert in this incident to a MITRE ATT&CK technique and sub-technique. Then tell me which tactic phase is most heavily represented and what that implies about attacker intent.And SAM will produce an analysis for you like below What have you used SAM to do? Did it save you time? 

Did you know Sam can create an exhaustive cyber kill chain analysis for an incident for you? You can use the prompt below to kick it off - and then of course continue the conversation.  Walk me through which stages of the Cyber Kill Chain this incident has evidence for, and what gaps exist that suggest the attacker may have done more that we haven't detected yet. (+10 more pages...) Don’t forget, you can always get Sam to create an “exec summary” for you using: summarize this in a couple of paragraphs for executive consumption   What are you favorite Sam prompts? please share anything Sam is good at, and also bad at!

Our documentation site page detailing our platform release notes highlights that in the November R1 2025 release of our application, a bug was fixed which is currently causing some confusion. Prior to this application release there was an option present in the application Menu > Administration > Access Control >  which allowed for the creation, modifying and deletion of Service API accounts. The same account controls were present for our Securonix internal service accounts. The use case details for of each of our UDS service accounts are provided on our documentation site. The application relies on these accounts for many internal processes and without the accounts many core functions do not work.For example, without these two ResponseServiceUser accounts - incident generation will not work correctly. In an effort to follow their company’s cyber security policies by limiting access some customers removed some of these accounts and effectively halted SOC operations. Currently t

Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to leverage this connector more effectively to build richer threat context, including malware attribution and related intelligence.As this is being raised as a feature request in ThreatQ, I wanted to check with the community: are there any alternative solutions or workarounds that others are using to enrich IOCs with malware attribution and deeper threat context?

You can find the tile to access TQ Marketplace on the main page. Or use this link: https://marketplace.threatq.com/