TruSTAR Platform Overview
1. Introducing TruSTAR
2. Product Architecture
3. Data Management
4. Data Processing
4.1 Data Processing: Collect
4.2 Data Processing: Prepare
4.3 Data Processing: Prioritize
4.4 Data Processing: Connect
5. Capabilities
5.1 Capabilities: Governance
5.2 Capabilities: Intelligence Workflows
5.3 Capabilities: Search
5.4 Capabilities: Scoring
5.5 Capabilities: Analytics
6. Interfaces
6.1 Interfaces: REST API
6.2 Interfaces: Integrations
6.3 Interfaces: Web App
7. Use Cases
7.1 Use Cases: Detect
7.2 Use Cases: Triage
7.3 Use Cases: Investigate
7.4 Use Cases: Disseminate
TruSTAR Ontology
Workflow Apps
Case Management
IBM Resilient
FAQ: TruSTAR for Resilient
Install: TruSTAR for Resilient
User Guide: TruSTAR for Resilient
JIRA
FAQ: TruSTAR for Jira
Install: TruSTAR for Jira
User Guide: TruSTAR for Jira
ServiceNow
FAQ: TruSTAR for ServiceNow
Install: TruSTAR for ServiceNow
User Guide: TruSTAR for ServiceNow
Overview: Case Management Workflow Apps
Orchestration
Demisto
User Guide: TruSTAR for Demisto
Creating a Demisto Playbook
Indicator Retrieval in Demisto
Indicator Searches in Demisto
Listing TruSTAR Enclaves in Demisto
Phishing Triage Commands for Demisto
Report Commands in Demisto
Report Searches in Demisto
Whitelisting with Demisto
FAQ: TruSTAR for Demisto
Install: TruSTAR for Demisto
Overview: Demisto
Phantom Cyber
FAQ: TruSTAR for Phantom Cyber
Install: TruSTAR for Phantom Cyber
User Guide: TruSTAR for Phantom Cyber
Detection
Splunk ES
Splunk Helpers
Check Splunk User Account Permissions.
FAQ: TruSTAR for Splunk ES
Install: TruSTAR App for Enterprise Security
User Guide: TruSTAR for Splunk ES
Splunk
FAQ: TruSTAR for Splunk v1.0.9
Install: TruSTAR for Splunk v1.0.9
IBM QRadar
FAQ: TruSTAR for IBM QRadar
Install: TruSTAR for IBM QRadar
User Guide: TruSTAR for IBM QRadar
Overview: Detection Workflow Apps
TAXII Applications
Anomali ThreatStream
LogRhythm
Palo Alto MineMeld
TAXII Client Basics
TAXII FAQ
TruSTAR TAXII Server
Other
TruSTAR Extension for Chrome
TruSTAR on Slack
TruSTAR API
Partner Resources
Integration Commands
Indicator Commands
Enrich Indicators in TruSTAR
Filter Indicators from TruSTAR
Get Phishing Indicators
Ingest Indicators from TruSTAR
Submit Indicators to TruSTAR
Whitelist Indicators
Report Commands
Enrich Reports in TruSTAR
Redact a Report in TruSTAR
Share a Report
Submit Report to TruSTAR
Triage Phishing Submissions
Case Management Integrations
Detection Integrations
Overview: Partner Resources
SOAR Integrations
TruSTAR Configuration Requirements
Python SDK
REST API
TruSTAR Web App
UI Walkthrough
Dashboard
Enclaves
Filter and Refine Panel
Indicators
MITRE ATT&CK Framework
Main Screen
Marketplace
Navigation Bar
Reports
Searching
TruSTAR Community Chat
Using Notes
Web App Walkthrough
Copying a Report
Emailing a Report
Exporting Report Data
Moving a Report
Overview: Reports
Redacting Data from a Report
Reports Graph View
Reports List View
Reports Panel
Submitting a Report
Tagging a Report
Updating a Report
Deleting Indicators
Exporting Indicators
IOC List View
Observable Graph View
Overview: Indicators
Tagging Indicators
Threat Actors
Uploading Indicators
Whitelisting Indicators
Phishing Triage
Overview: Phishing Triage
Phishing Triage API
Phishing Triage Python SDK
Phishing Workflow in the TruSTAR Web App
Using Phishing Triage with Detection Tools
Using Phishing Triage with Orchestration Tools
Using Phishing Triage with a TAXII Client
User Settings
Editing Your Profile
Notifications
Admin Features
Single Sign-On (SSO)
Okta (SSO)
Ping Identity (SSO)
Salesforce (SSO)
Enclave Inbox
Automating Forwarding to an Enclave Inbox
Setting up an Enclave Inbox with Proofpoint
Managing Users
Managing the Company Whitelist
Managing the Redaction Library
Setting Up Multi-Factor Authentication (MFA)
Setting up a Service Account
Overview: TruSTAR Web App
Intelligence Sources
Digital Risk/ATO
Digital Shadows
RiskIQ PassiveTotal
RiskIQ Blacklist Intelligence
Shape Blackfish
SpyCloud
Endpoint
Cisco AMP Threat Grid
Cisco AMP Threat Grid Indicator Query
Crowdstrike Falcon Detect
Crowdstrike Falcon Intelligence
Crowdstrike Falcon Reports
Threat Intelligence
Dragos WorldView
FireEye iSight
IBM X-Force
IBM X-Force IRIS
Intel 471 Adversary Intelligence
Intel 471 Alerts
Intel 471 Malware Intelligence
Recorded Future Hash Intelligence
Recorded Future IP Intelligence
Recorded Future URL Intelligence
Recorded Future Vulnerability Intelligence
VirusTotal
urlscan
Trusted Community
A-ISAC
F-ISAC
FS-ISAC
NCFTA CyFin and TNT
AWS GuardDuty
Alienvault OTX Pulse
Cybersource
Facebook Threat Exchange
Farsight Security
Hybrid Analysis
Joe Sandbox
TAXII Client
Threat Intelligence Platform
MISP (v2)
FAQ: TruSTAR for MISP (v2)
Install: TruSTAR for MISP (v2)
User Guide: TruSTAR for MISP (v2)
Technical Info
Intel Feeds Source URLs
OSINT Sources Tech Specs
Premium Intel Sources Tech Specs
RSS Open Sources Tech Specs
COVID-19 OSINT Community Enclave
How Intelligence Sources are Updated
Overview: Intelligence Sources
Scripted Extensions
Enclave Scripts
Automated Sharing Between Enclaves
Script: Correlations Between Enclaves
Script: Deleting Reports
Script: Domain-level URL Filtering
Script: Exporting Indicators
Script: Moving Data Between Enclaves
Scripts: Uploading Data
Managed Connectors
ArcSight: Upload Events to TruSTAR
Azure Sentinel: Import Indicators from TruSTAR
Crowdstrike Falcon: Import Indicators from TruSTAR
Cybereason: Import Indicators from TruSTAR
MISP: Import Reports or Indicators from TruSTAR
Overview: Managed Connectors
Proofpoint: URL Decoder
SecureWorks: Send Indicators to TruSTAR
Splunk Enterprise: Import Indicators from TruSTAR
Splunk Phantom: Enrich Notable Events
Report Correlation Email
Vetting and Tagging Indicators
Technology
TruSTAR Scoring
Normalized Indicator Scores
Priority Event Scores
Priority Indicator Scores
Auto-Whitelist
Redaction Library
FAQs
TruSTAR Policies
API Usage Policy
Privacy Policy
Applications Integrations FAQ
Clearing browser cookies and caches
Contacting TruSTAR Support
Entity Extraction FAQ
Finding Enclave IDs
Finding Report IDs
Finding Your API Keys
Indicators Supported by TruSTAR
Intelligence Sources FAQ
Login FAQ
Request to Archive Premium Intel Source
Security FAQ
Uploading Indicators FAQ
What is the TruSTAR Community?
All Categories > TruSTAR Web App > UI Walkthrough
13 articles
Start here to learn about the TruSTAR Web App
Updated 2 weeks ago by Elvis Hovor
Displays the most current trends, insights, and analytics for a selected Enclave
Updated 4 weeks ago by Sachit Soni
Explains what an Enclave is and how it is used in TruSTAR.
Updated 4 weeks ago by Elvis Hovor
How to filter and refine information in Enclaves
Internal information, such as cases, reports, or emails can contain data about an event on a network or device. These Events contain Observables , such as URLs, hashes, or email addresses. When you s…
Using the MiTRE ATT&CK knowledgebase to tag or filter information in Enclaves
Explains the sections of the "home" screen for the TruSTAR Web App
Using the Marketplace to view and subscribe to external intelligence sources
Updated 2 months ago by Sachit Soni
Explains the left-side navigation bar in the TruSTAR Web App
Updated 2 months ago by Elvis Hovor
A TruSTAR Report is a body of structured and/or unstructured data that is uploaded to TruSTAR, where it is stored in a specific enclave and any indicators in the report are extracted and enriched wit…
Searching for specific terms in Intel Reports or Indicators
Accessing the TruSTAR Community Chat on Slack
Adding notes to Intel Reports or Indicators
Updated 6 months ago by Shimon Modi
Updated 4 weeks ago
by
Elvis Hovor
