RiskIQ Blacklist Intelligence
This document explains how to set up and use RiskIQ Blacklist Intelligence with TruSTAR Station.
RiskIQ's Blacklist Intelligence delivers curated lists of known bad URLs, Domains, and IP addresses associated with malware, phishing, and scam events.
- Time to Install: 10 minutes
- Type of Feed: Automatic updates
- Update Frequency: 15 minutes
- Intel Type: Premium Feed
The integration pulls reports with these observables from RiskIQ Blacklist Intelligence:
- Hostname (Domain/url in TruSTAR)
- Licensed user of RiskIQ
- API key for RiskIQ Blacklist lookup
- Log into TruSTAR Station.
- Click the Marketplace icon on the left side icon list.
- Click Closed Sources.
- Click Subscribe on the RiskIQ Blacklist box.
- Enter your PassiveTotal API key and click Save Credentials & Request Subscription.
TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.
IOC Type <IOC Value> Example: IP 22.214.171.124
<base64(IOC Value)> Example: OTkuNDUuNzIuMzQ=
Alternative IOC Type <IOC Value> Example: IP126.96.36.199
Full JSON response
"detectedAt" field of response Example: 2017-05-10T17:29:33.000-0700
"score" field of response (Example: Score:100) + phishing:true
Note only when value is true for either of these fields: "phishing":true,"malware":false,"spam":false,"scam":true)
Note: Tags of more than 32 characters are ignored.
Client Meta Tag
No reported issues.