Threat Intelligence

1. Introducing TruSTAR

2. Product Architecture

3. Data Management

4. Data Processing

4.1 Data Processing: Collect

4.2 Data Processing: Prepare

4.3 Data Processing: Prioritize

4.4 Data Processing: Connect

5. Capabilities

5.1 Capabilities: Governance

5.2 Capabilities: Intelligence Workflows

5.3 Capabilities: Search

5.4 Capabilities: Scoring

5.5 Capabilities: Analytics

6. Interfaces

6.1 Interfaces: REST API

6.2 Interfaces: Integrations

6.3 Interfaces: Web App

7. Use Cases

7.1 Use Cases: Detect

7.2 Use Cases: Triage

7.3 Use Cases: Investigate

7.4 Use Cases: Disseminate

TruSTAR Ontology

FAQ: TruSTAR for Resilient

Install: TruSTAR for Resilient

User Guide: TruSTAR for Resilient

FAQ: TruSTAR for Jira

Install: TruSTAR for Jira

User Guide: TruSTAR for Jira

FAQ: TruSTAR for ServiceNow

Install: TruSTAR for ServiceNow

User Guide: TruSTAR for ServiceNow

Overview: Case Management Workflow Apps

Creating a Demisto Playbook

Indicator Retrieval in Demisto

Indicator Searches in Demisto

Listing TruSTAR Enclaves in Demisto

Phishing Triage Commands for Demisto

Report Commands in Demisto

Report Searches in Demisto

User Guide: TruSTAR for Demisto

Whitelisting with Demisto

FAQ: TruSTAR for Demisto

Install: TruSTAR for Demisto

Overview: Demisto

FAQ: TruSTAR for Phantom Cyber

Install: TruSTAR for Phantom Cyber

User Guide: TruSTAR for Phantom Cyber

Check Splunk User Account Permissions.

FAQ: TruSTAR for Splunk ES

Install: TruSTAR App for Enterprise Security

User Guide: TruSTAR for Splunk ES

FAQ: TruSTAR for Splunk v1.0.9

Install: TruSTAR for Splunk v1.0.9

FAQ: TruSTAR for IBM QRadar

Install: TruSTAR for IBM QRadar

User Guide: TruSTAR for IBM QRadar

Overview: Detection Workflow Apps

Anomali ThreatStream

LogRhythm

Palo Alto MineMeld

TAXII Client Basics

TAXII FAQ

TruSTAR TAXII Server

TruSTAR Extension for Chrome

TruSTAR on Slack

Enrich Indicators in TruSTAR

Filter Indicators from TruSTAR

Get Phishing Indicators

Ingest Indicators from TruSTAR

Submit Indicators to TruSTAR

Whitelist Indicators

Enrich Reports in TruSTAR

Redact a Report in TruSTAR

Share a Report

Submit Report to TruSTAR

Triage Phishing Submissions

Case Management Integrations

Detection Integrations

Overview: Partner Resources

SOAR Integrations

TruSTAR Configuration Requirements

Python SDK

REST API

Dashboard

Enclaves

Filter and Refine Panel

Indicators

MITRE ATT&CK Framework

Main Screen

Marketplace

Navigation Bar

Reports

Searching

TruSTAR Community Chat

Using Notes

Web App Walkthrough

Copying a Report

Emailing a Report

Exporting Report Data

Moving a Report

Overview: Reports

Redacting Data from a Report

Reports Graph View

Reports List View

Reports Panel

Submitting a Report

Tagging a Report

Updating a Report

Deleting Indicators

Exporting Indicators

IOC List View

Observable Graph View

Overview: Indicators

Tagging Indicators

Threat Actors

Uploading Indicators

Whitelisting Indicators

Overview: Phishing Triage

Phishing Triage API

Phishing Triage Python SDK

Phishing Workflow in the TruSTAR Web App

Using Phishing Triage with Detection Tools

Using Phishing Triage with Orchestration Tools

Using Phishing Triage with a TAXII Client

Editing Your Profile

Notifications

User Settings

Okta (SSO)

Ping Identity (SSO)

Salesforce (SSO)

Automating Forwarding to an Enclave Inbox

Enclave Inbox

Setting up an Enclave Inbox with Proofpoint

Managing Users

Managing the Company Whitelist

Managing the Redaction Library

Setting Up Multi-Factor Authentication (MFA)

Setting up a Service Account

Overview: TruSTAR Web App

Digital Shadows

RiskIQ PassiveTotal

RiskIQ Blacklist Intelligence

Shape Blackfish

SpyCloud

Cisco AMP Threat Grid

Cisco AMP Threat Grid Indicator Query

Crowdstrike Falcon Detect

Crowdstrike Falcon Intelligence

Crowdstrike Falcon Reports

Dragos WorldView

FireEye iSight

IBM X-Force

IBM X-Force IRIS

Intel 471 Adversary Intelligence

Intel 471 Alerts

Intel 471 Malware Intelligence

Recorded Future Hash Intelligence

Recorded Future IP Intelligence

Recorded Future URL Intelligence

Recorded Future Vulnerability Intelligence

VirusTotal

urlscan

A-ISAC

F-ISAC

FS-ISAC

NCFTA CyFin and TNT

AWS GuardDuty

Alienvault OTX Pulse

Cybersource

Facebook Threat Exchange

Farsight Security

Hybrid Analysis

Joe Sandbox

TAXII Client

FAQ: TruSTAR for MISP (v2)

Install: TruSTAR for MISP (v2)

User Guide: TruSTAR for MISP (v2)

Intel Feeds Source URLs

OSINT Sources Tech Specs

Premium Intel Sources Tech Specs

RSS Open Sources Tech Specs

COVID-19 OSINT Community Enclave

How Intelligence Sources are Updated

Overview: Intelligence Sources

Automated Sharing Between Enclaves

Script: Correlations Between Enclaves

Script: Deleting Reports

Script: Domain-level URL Filtering

Script: Exporting Indicators

Script: Moving Data Between Enclaves

Scripts: Uploading Data

ArcSight: Upload Events to TruSTAR

Azure Sentinel: Import Indicators from TruSTAR

Crowdstrike Falcon: Import Indicators from TruSTAR

Cybereason: Import Indicators from TruSTAR

MISP: Import Reports or Indicators from TruSTAR

Overview: Managed Connectors

Proofpoint: URL Decoder

SecureWorks: Send Indicators to TruSTAR

Splunk Enterprise: Import Indicators from TruSTAR

Splunk Phantom: Enrich Notable Events

Report Correlation Email

Vetting and Tagging Indicators

Normalized Indicator Scores

Priority Event Scores

Priority Indicator Scores

Auto-Whitelist

Redaction Library

API Usage Policy

Applications Integrations FAQ

Clearing browser cookies and caches

Contacting TruSTAR Support

Entity Extraction FAQ

Finding Enclave IDs

Finding Report IDs

Finding Your API Keys

Indicators Supported by TruSTAR

Intelligence Sources FAQ

Request to Archive Premium Intel Source

Security FAQ

Uploading Indicators FAQ

What is the TruSTAR Community?

All Categories > Intelligence Sources > Threat Intelligence

13 articles

Dragos WorldView

How to install and use Dragos WorldView with the TruSTAR Web App

Updated 1 week ago by TruSTAR

FireEye iSight

How to set up and use FireEye iSight with the TruSTAR Web App.

Updated 1 week ago by TruSTAR

IBM X-Force

How to set up and use IBM X-Force with TruSTAR Station.

Updated 1 week ago by TruSTAR

IBM X-Force IRIS

How to set up and use IBM X-Force IRIS with TruSTAR Station.

Updated 1 week ago by TruSTAR

Intel 471 Adversary Intelligence

How to set up and use Intel 471 Adversary Intelligence with TruSTAR Station.

Updated 1 week ago by TruSTAR

Intel 471 Alerts

How to set up and use Intel 471 Alerts with TruSTAR Station.

Updated 1 week ago by TruSTAR

Intel 471 Malware Intelligence

How to set up and use Intel 471 Malware Intelligence with TruSTAR Station.

Updated 1 week ago by TruSTAR

Recorded Future Hash Intelligence

How to set up and use the Recorded Future Hash List with TruSTAR Station.

Updated 1 week ago by TruSTAR

Recorded Future IP Intelligence

How to set up and use the Recorded Future IP List with TruSTAR Station.

Updated 1 week ago by TruSTAR

Recorded Future URL Intelligence

How to set up the Recorded Future URL List with TruSTAR Station.

Updated 1 week ago by TruSTAR

Recorded Future Vulnerability Intelligence

How to set up and use the Recorded Future Vulnerability List with TruSTAR Station.

Updated 1 week ago by Elvis Hovor

VirusTotal

How to set up and use VirusTotal with TruSTAR Station.

Updated 1 week ago by TruSTAR

urlscan

This document explains how to set up and use the urlscan premium intelligence source with the TruSTAR Web App. The urlscan is a free-mium service which virtually allows anyone to analyze unknown or p…

Updated 1 week ago by TruSTAR

(opens in a new tab)