Guillaume BOURGEOIS
8f3d9607df
ThreatQ REST API, 5 commands: search/get indicators, create indicator, list events. OAuth2 password-grant auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
2.5 KiB
YAML
79 lines
2.5 KiB
YAML
id: threatq
|
|
name: ThreatQ
|
|
version: 1.0.0
|
|
description: "ThreatQuotient ThreatQ (REST API) — threat intelligence: search and read indicators, create an indicator, and list events. OAuth2 password-grant authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: search/get indicators, create indicator, list events."
|
|
category: threat_intel
|
|
|
|
# Per-instance configuration. Credentials are exchanged for a bearer token at
|
|
# /api/token; API calls go to /api.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "ThreatQ URL (e.g. https://threatq.example.com)"
|
|
client_id:
|
|
type: string
|
|
description: "OAuth client ID"
|
|
email:
|
|
type: string
|
|
description: "ThreatQ user email"
|
|
password:
|
|
type: string
|
|
description: "ThreatQ password"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- base_url
|
|
- client_id
|
|
- email
|
|
- password
|
|
|
|
commands:
|
|
- id: search_indicators
|
|
name: threatq-search-indicators
|
|
description: "Search indicators by value."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "Indicator value to search" }
|
|
limit: { type: number, description: "Max indicators (default 25)" }
|
|
required: [value]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_indicator
|
|
name: threatq-get-indicator
|
|
description: "Get a single indicator by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
indicator_id: { type: string, description: "Indicator ID" }
|
|
required: [indicator_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: create_indicator
|
|
name: threatq-create-indicator
|
|
description: "Create an indicator."
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "Indicator value" }
|
|
type: { type: string, description: "Indicator type (e.g. IP Address, FQDN, MD5)" }
|
|
status: { type: string, description: "Status (e.g. Active, Review) — default Review" }
|
|
required: [value, type]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_events
|
|
name: threatq-list-events
|
|
description: "List events."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max events (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: threatq-test-connection
|
|
description: "Verify credentials via the token exchange (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|