Updated 2 weeks ago by TruSTAR

This document explains how to set up and use the NCFTA CyFin and NCFTA TNT premium intelligence source with the TruSTAR Web App.

The National Cyber-Forensics & Training Alliance (NCFTA) is a non-profit corporation founded in 2002, focused on identifying, mitigating, and neutralizing cyber crime threats globally. The NCFTA operates by conducting real time information sharing and analysis with Subject Matter Experts (SME) in the public, private, and academic sectors. Collaboration with partners has resulted in countless criminal and civil investigations having been initiated, that otherwise may not have been addressed. To date, the NCFTA has provided intelligence which has aided in the successful prosecution of hundreds of cyber criminals worldwide.

  • Source Type: Premium Intel
  • Update Type: Feed-based
  • Update Frequency: 10 minutes
  • Time to Install: 10 minutes

Data Types

The integration pulls all Observables supported by TruSTAR.


  • A subscription to NCFTA
TruSTAR Admin rights are required to activate this Premium Intelligence feed.

Getting Started

  1. Log into the TruSTAR Web App.
  2. Click the Marketplace icon on the left side icon list.
  3. Click Premium Intel.
  4. Click Subscribe on the NCFTA List box.
  5. Enter your NCFTA API key and click Save Credentials & Request Subscription.

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

TruSTAR Report Mapping



Report Title


External ID


Example: "999999-[TNT-0009999]"

Time Begun


Client Type

Python SDK

Client Meta Tag


Known Issues

No reported issues.

Please reach out to if you have issues with this integration.

How Did We Do?