RiskIQ Blacklist Intelligence

Updated 1 week ago by Elvis Hovor

This document explains how to set up and use RiskIQ Blacklist Intelligence with TruSTAR Station.

RiskIQ's Blacklist Intelligence delivers curated lists of known bad URLs, Domains, and IP addresses associated with malware, phishing, and scam events.

  • Source Type: Premium Intel
  • Update Type: Query-based
  • Time to Install: 10 minutes

Data Types

The integration pulls reports with these observables from RiskIQ Blacklist Intelligence:

  • IP
  • URL
  • Domain (Extracted from URL by TruSTAR)

Requirements

  • Licensed user of RiskIQ
  • API key for RiskIQ Blacklist lookup
TruSTAR Admin rights are required to activate this Premium Intel feed.

Getting Started

  1. Log into TruSTAR Station.
  2. Click the Marketplace icon on the left side icon list.
  3. Click  Closed Sources.
  4. Click Subscribe on the RiskIQ Blacklist box.
  5. Enter your PassiveTotal API key and click Save Credentials & Request Subscription.
You can find your Blacklist API keys here: https://api.riskiq.net/api/manage_apikey.html

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

Report Mapping

Field 

Explanation

Example

Report Title

IOC Type <IOC Value>

IP XX.45.72.XX

External ID

<base64(IOC Value)>

Alternative IOC Type <IOC  Value>

 IPXX.45.72.XX

Report Body

Full JSON response

Time Begun

"detectedAt" field of response

2019-05-10T17:29:33.000-0700

Tags

"score" field of response. Tags of more than 32 characters are ignored.

Note only when value is true for either of these fields: "phishing":true,"malware":false,"spam":false,"scam":true)

Score:100) + phishing:true

Deeplink

None

Client Type

PYTHON SDK

Client Meta Tag

stash_riskiqblacklist

Known Issues

No reported issues.

Please reach out to support@trustar.co if you have issues with this integration.

How Did We Do?