Skip to main content
Question

Phone Number and Bank Account Number Identification

  • February 5, 2026
  • 2 replies
  • 76 views
M
New Member

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.

We need to be able to identify the IOCs within this data and add them to the event as an indicator so we can send it to over to Tines. I am wondering if anyone else has been able to do this successfully before? We have put in a feature request to get an ace parser created that can hopefully do what we are needing but, I want to see if there is an alternative method. 

 

    2 replies

    ChrisJacob
    Forum|alt.badge.img+1
    • ChrisJacob
    • Employee
    • February 10, 2026

    Hey Makala, thanks for being part of the community. Are you using the FISAC CDF (Downloaded from the marketplace) or are you pulling in the STIX feed over TAXII?

    P
    New Participant
    Forum|alt.badge.img
    • PuckNew Participant
    • New Participant
    • May 11, 2026

    We are expecting the NCSC’s Share and Defend program, shared over MISP feed, to start to include telephone numbers in the near future. We would also like to ingest the GSMA telco data, so would really benefit from this. 

    Also, when investigating doxing and making WhatsApp or other telephone number relationships, the Identity entity is useful for determining relational links between the users of phone numbers, but can get confusing if this is also used for the telephone numbers themselves.

      Terms & ConditionsAccessibility statement