Collect ThreatConnect IOC logs

This parser extracts IOC data from ThreatConnect JSON logs and transforms it into the UDM format. It handles various IOC types such as Host, Address, File, and URL, mapping fields like confidence scores, descriptions, and entity details to their corresponding UDM equivalents, and categorizes threats based on keywords within the log data.

Before you begin

Ensure that you have the following prerequisites:

• Google Security Operations instance.
• Privileged access to ThreatConnect.

Configure API User on ThreatConnect

1. Sign in to ThreatConnect.
2. Go to Settings > Org Settings.
3. Go to the Membership tab in the Organization Settings.
4. Click Create API User.

5. Fill out the fields on the API User Administration window:

   • First Name: enter the API user's first name.
   • Last Name: enter the API user's last name
   • System Role: select the Api User or Exchange Admin System role.
   • Organization Role: select the API user's Organization role.
   • Include in Observations and False Positives: select the checkbox to allow data provided by the API user to be included in observation and false-positive counts.
   • Disabled: click the checkbox to disable an API user's account in the event that the Administrator wants to retain log integrity.
   • Copy and save the Access ID and Secret Key.

6. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds
• Content Hub > Content Packs

Set up feeds from SIEM Settings > Feeds

To configure a feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed; for example, ThreatConnect Logs.
5. Select Third Party API as the Source type.
6. Select the ThreatConnect as the log type.
7. Click Next.
8. Specify values for the following input parameters:
   • Username: enter the ThreatConnect Access ID to authenticate as.
   • Secret: enter the ThreatConnect Secret Key for the specified user.
   • API Hostname: Fully Qualified Domain Name (FQDN) of your ThreatConnect instance (for example, <myinstance>.threatconnect.com).
   • Owners: all owner names, where the owner identifies a collection of IOCs.
9. Click Next.
10. Review the feed configuration in the Finalize screen, and then click Submit.

Set up feeds from the Content Hub

Specify values for the following fields:

• Username: enter the ThreatConnect Access ID to authenticate as.
• Secret: enter the ThreatConnect Secret Key for the specified user.
• API Hostname: Fully Qualified Domain Name (FQDN) of your ThreatConnect instance (for example, <myinstance>.threatconnect.com).
• Owners: all owner names, where the owner identifies a collection of IOCs.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Source Type: Method used to collect logs into Google SecOps.
• Asset Namespace: Namespace associated with the feed.
• Ingestion Labels: Labels applied to all events from this feed.

Need more help? Get answers from Community members and Google SecOps professionals.