feat(threatq): new ThreatQ threat-intel integration

ThreatQ REST API, 5 commands: search/get indicators, create indicator, list events. OAuth2 password-grant auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:49:17 +02:00
parent a2f2b8efa0
commit 8f3d9607df
6 changed files with 433 additions and 0 deletions
@@ -0,0 +1,78 @@
+id: threatq
+name: ThreatQ
+version: 1.0.0
+description: "ThreatQuotient ThreatQ (REST API) — threat intelligence: search and read indicators, create an indicator, and list events. OAuth2 password-grant authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: search/get indicators, create indicator, list events."
+category: threat_intel
+
+# Per-instance configuration. Credentials are exchanged for a bearer token at
+# /api/token; API calls go to /api.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "ThreatQ URL (e.g. https://threatq.example.com)"
+    client_id:
+      type: string
+      description: "OAuth client ID"
+    email:
+      type: string
+      description: "ThreatQ user email"
+    password:
+      type: string
+      description: "ThreatQ password"
+      x-soar-sensitive: true
+  required:
+    - base_url
+    - client_id
+    - email
+    - password
+
+commands:
+  - id: search_indicators
+    name: threatq-search-indicators
+    description: "Search indicators by value."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Indicator value to search" }
+        limit: { type: number, description: "Max indicators (default 25)" }
+      required: [value]
+    outputs_schema: { properties: {} }
+  - id: get_indicator
+    name: threatq-get-indicator
+    description: "Get a single indicator by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        indicator_id: { type: string, description: "Indicator ID" }
+      required: [indicator_id]
+    outputs_schema: { properties: {} }
+  - id: create_indicator
+    name: threatq-create-indicator
+    description: "Create an indicator."
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Indicator value" }
+        type: { type: string, description: "Indicator type (e.g. IP Address, FQDN, MD5)" }
+        status: { type: string, description: "Status (e.g. Active, Review) — default Review" }
+      required: [value, type]
+    outputs_schema: { properties: {} }
+  - id: list_events
+    name: threatq-list-events
+    description: "List events."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max events (default 25)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: threatq-test-connection
+    description: "Verify credentials via the token exchange (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }