Cases

Dashboard

Enclaves

Filter and Refine Panel

MITRE ATT&CK Framework

Main Screen

Marketplace

Navigation Bar

Searching

TruSTAR Community Chat

UI Tour (with Links)

Using Notes

Copying a Report

Emailing a Report

Exporting Report Data

Moving a Report

Overview: Reports

Redacting Data from a Report

Reports Graph View

Reports List View

Reports Panel

Submitting a Report

Tagging a Report

Updating a Report

Deleting Indicators

Exporting Indicators

IOC Graph View

IOC List View

Overview: Indicators

Tagging Indicators

Threat Actors

Uploading Indicators

Whitelisting Indicators

Overview: Phishing Triage

Phishing Triage API

Phishing Triage Python SDK

Phishing Workflow in the TruSTAR Web App

Using Phishing Triage with Orchestration Tools

Using Phishing Triage with SIEM Tools

Using Phishing Triage with a TAXII Client

Editing Your Profile

Notifications

User Settings

Okta (SSO)

Ping Identity (SSO)

Automating Forwarding to an Enclave Inbox

Enclave Inbox

Setting up an Enclave Inbox with Proofpoint

Managing Users

Managing the Company Whitelist

Managing the Redaction Library

Setting Up Multi-Factor Authentication (MFA)

Setting up a Service Account

Automated Sharing Between Enclaves

Script: Correlations Between Enclaves

Script: Deleting Reports

Script: Domain-level URL Filtering

Script: Exporting Indicators

Script: Moving Data Between Enclaves

Scripts: Uploading Data

ArcSight: Upload Events to TruSTAR

Azure Sentinel: Import Indicators from TruSTAR

Crowdstrike Falcon: Import Indicators from TruSTAR

Cybereason: Import Indicators from TruSTAR

MISP: Import Reports or Indicators from TruSTAR

Overview: Managed Connectors

Proofpoint: URL Decoder

SecureWorks: Send Indicators to TruSTAR

Splunk Enterprise: Import Indicators from TruSTAR

Splunk Phantom: Enrich Notable Events

Report Correlation Email

Vetting and Tagging Indicators

FAQ: TruSTAR for Resilient

Install: TruSTAR for Resilient

User Guide: TruSTAR for Resilient

FAQ: TruSTAR for Jira

Install: TruSTAR for Jira

User Guide: TruSTAR for Jira

FAQ: TruSTAR for ServiceNow

Install: TruSTAR for ServiceNow

User Guide: TruSTAR for ServiceNow

Creating a Demisto Playbook

Indicator Retrieval in Demisto

Indicator Searches in Demisto

Listing TruSTAR Enclaves in Demisto

Phishing Triage Commands for Demisto

Report Commands in Demisto

Report Searches in Demisto

User Guide: TruSTAR for Demisto

Whitelisting with Demisto

FAQ: TruSTAR for Demisto

Install: TruSTAR for Demisto

Overview: Demisto

FAQ: TruSTAR for Phantom Cyber

Install: TruSTAR for Phantom Cyber

User Guide: TruSTAR for Phantom Cyber

FAQ: TruSTAR for Splunk ES

Install: TruSTAR for Splunk ES

User Guide: TruSTAR for Splunk ES

FAQ: TruSTAR for Splunk v1.0.9

Install: TruSTAR for Splunk v1.0.9

FAQ: TruSTAR for IBM QRadar

Install: TruSTAR for IBM QRadar

User Guide: TruSTAR for IBM QRadar

Anomali ThreatStream

LogRhythm

Palo Alto MineMeld

TAXII Client Basics

TAXII FAQ

TruSTAR TAXII Server

TruSTAR Extension for Chrome

TruSTAR on Slack

Digital Shadows

RiskIQ PassiveTotal

RiskIQ Blacklist Intelligence

Shape Blackfish

SpyCloud

Cisco AMP Threat Grid

Cisco AMP Threat Grid Indicator Query

Crowdstrike Falcon Detect

Crowdstrike Falcon Intelligence

Crowdstrike Falcon Reports

Dragos WorldView

FireEye iSight

IBM X-Force

IBM X-Force IRIS

Intel 471 Adversary Intelligence

Intel 471 Alerts

Intel 471 Malware Intelligence

Recorded Future Hash Intelligence

Recorded Future IP Intelligence

Recorded Future URL Intelligence

Recorded Future Vulnerability Intelligence

VirusTotal

A-ISAC

F-ISAC

FS-ISAC

NCFTA CyFin and TNT

AWS GuardDuty

Alienvault OTX Pulse

Cybersource

Facebook Threat Exchange

Farsight Security

Hybrid Analysis

Joe Sandbox

MISP

TAXII Client

Intel Feeds Source URLs

OSINT Sources Tech Specs

Premium Intel Sources Tech Specs

RSS Open Sources Tech Specs

COVID-19 OSINT Community Enclave

How Intelligence Sources are Updated

Intro to Intelligence Sources

Normalized Indicator Scores

Priority Event Scores

Priority Indicator Scores

Auto-Whitelist

Python SDK

REST API

Redaction Library

API Usage Policy

Applications Integrations FAQ

Clearing browser cookies and caches

Contacting TruSTAR Support

Entity Extraction FAQ

Finding Enclave IDs

Finding Report IDs

Finding Your API Keys

Intelligence Sources FAQ

Observables Supported by TruSTAR

Request to Archive Premium Intel Source

Security FAQ

Uploading Observables FAQ

What is the TruSTAR Community?

Release Notes

Enrich Indicators in TruSTAR

Enrich Reports in TruSTAR

Filter Indicators from TruSTAR

Get Phishing Indicators

Ingest Indicators from TruSTAR

Redact a Report in TruSTAR

Share a Report

Submit Indicators to TruSTAR

Submit Report to TruSTAR

Triage Phishing Submissions

Whitelist Indicators

Case Management Integrations

Overview: Partner Resources

SIEM Integrations

SOAR Integrations

TruSTAR Configuration Requirements

All Categories > Partner Resources > SIEM Integrations

SIEM Integrations

Updated 1 month ago by Sachit Soni

Integrating a SIEM tool with TruSTAR can support the exchange of data between the two platforms, providing enriched data that the SIEM tool can use in real-time analysis of security threats.

Please reference the Partner Portal Overview for details on configuration and functional requirements.

Recommended Functions

Optional Functions

How Did We Do?

(opens in a new tab)

SIEM Integrations

Recommended Functions

Optional Functions

How Did We Do?

Related Articles Overview: Partner Resources User Guide: TruSTAR for IBM QRadar FAQ: TruSTAR for IBM QRadar

Contact

Related Articles

Overview: Partner Resources

User Guide: TruSTAR for IBM QRadar

FAQ: TruSTAR for IBM QRadar