NCFTA

Updated 1 week ago by Sachit Soni

This document explains how to set up and use NCFTA CyFin and NCFTA TNT with TruSTAR Station.

The National Cyber-Forensics & Training Alliance (NCFTA) is a non-profit corporation founded in 2002, focused on identifying, mitigating, and neutralizing cyber crime threats globally. The NCFTA operates by conducting real time information sharing and analysis with Subject Matter Experts (SME) in the public, private, and academic sectors. Collaboration with partners has resulted in countless criminal and civil investigations having been initiated, that otherwise may not have been addressed. To date, the NCFTA has provided intelligence which has aided in the successful prosecution of hundreds of cyber criminals worldwide.

  • Time to Install: 10 minutes
  • Type of Feed: Automatic updates
  • Update Frequency: 15 minutes
  • Intel Type: Premium

Data Types

The integration pulls all observables supported by TruSTAR.

Requirements

  • A subscription to NCFTA
  • NCFTA API Key
TruSTAR admin rights are required to activate this Premium Intel feed.

Getting Started

  1. Log into TruSTAR Station
  2. Click the Marketplace icon on the left side icon list.
  3. Click Closed Sources.
  4. Click Subscribe on the NCFTA List box.
  5. Enter your NCFTA API key and click Save Credentials & Request Subscription.

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

TruSTAR Report Mapping

Field 

Explanation

Report Title

"NCFTA-[LISTNAME]-[AutoID]"

External ID

"[AutoID]-[ThreadID]" e.g. "487345-[TNT-0003514]"

Time Begun

"CreatedDate"

Client Type

Python SDK

Client Meta Tag

stash_ncfta

Known Issues

No reported issues.

Please reach out to support@trustar.co if you have issues with this integration.

How Did We Do?