RiskIQ Blacklist
Updated 1 month ago
by
TruSTAR
This document explains how to set up the RiskIQ Blacklist premium intelligence source in the TruSTAR platform.
RiskIQ's Blacklist delivers curated lists of known bad URLs, Domains, and IP addresses associated with malware, phishing, and scam events.
- Source Type: Premium Intel
- Update Type: Query-based
- Parser: Yes
- Time to Install: 10 minutes
Observables Supported
- IP
- URL
- Domain (Extracted from URL by TruSTAR)
Requirements
- Licensed user of RiskIQ
- API key for RiskIQ Blacklist lookup
Getting Started
- Log into the TruSTAR Web App.
- Click the Marketplace icon on the Navigation Bar.
- Click Premium Intel.
- Click Subscribe on the RiskIQ Blacklist box.
- Enter your RiskIQ API key and click Save Credentials & Request Subscription.
TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.
TruSTAR Report Mapping
The information retrieved from this intelligence source is stored in the RiskIQ Blacklist Enclave using this format.
Field | Explanation | Example |
Report Title | IOC Type <IOC Value> | IP XX.45.72.XX |
External ID | <base64(IOC Value)> Alternative IOC Type <IOC Value> | IPXX.45.72.XX |
Report Body | Full JSON response | |
Time Begun | "detectedAt" field of response | 2019-05-10T17:29:33.000-0700 |
Tags | "score" field of response. Tags of more than 32 characters are ignored. Note only when value is true for either of these fields: "phishing":true,"malware":false,"spam":false,"scam":true) | Score:100) + phishing:true |
Deeplink | None | |
Client Type | PYTHON SDK | |
Client Meta Tag | stash_riskiqblacklist |
Known Issues
No reported issues.
