ThreatConnect
Threat Intelligence- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The ThreatConnect connector integrates with the ThreatConnect Threat Intelligence Platform. It synchronizes threat-intelligence groups (campaigns, incidents, reports, documents, emails, signatures, tasks, etc.) and indicators (addresses, hosts, files, URLs, and other IOCs) into the Brinqa platform using the ThreatConnect REST API v3.
Data retrieved from ThreatConnect
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Group | Yes | (none — standalone object class) |
| Indicator | Yes | (none — standalone object class) |
Model relationships
For detailed steps on how to view the data retrieved from ThreatConnect in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select ThreatConnect from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | — | ThreatConnect server URL |
| Access id | Yes | — | ThreatConnect API access id |
| Secret key | Yes | — | ThreatConnect API secret key |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, CPU cores) | Maximum number of parallel API requests |
| SSL / TLS | No | false | Skip certificate verification |
Authentication
Method
HMAC (HMAC-SHA256) request signing using an Access ID and Secret Key issued by ThreatConnect.
Endpoint
The connection is validated with a lightweight request:
| Method | URL |
|---|---|
GET | https://<instance>/api/v3/indicators?resultLimit=1 |
Request Headers
Each request is signed and carries the following headers:
| Header | Value |
|---|---|
Authorization | TC <accessId>:<base64(HMAC-SHA256(signature))> |
Timestamp | Unix epoch seconds at request time |
The signature is computed over "<uriPathWithQuery>:<httpMethod>:<timestamp>" using the Secret Key, then HMAC-SHA256 signed and Base64-encoded.
Sample Signed Request
GET /api/v3/indicators?resultLimit=1 HTTP/1.1
Host: <instance>
Authorization: TC <accessId>:b3BlbnNzbC1iYXNlNjQtaG1hYy1zaGEyNTYtc2lnbmF0dXJl
Timestamp: 1717977600
Accept: application/json
Token / Response Fields
Not applicable. ThreatConnect uses per-request HMAC signing rather than a credential-exchange flow, so there is no authentication request body, token response, or token-response field mapping. Each request is signed inline using the Access ID and Secret Key; there is no token to store or reuse.
Usage
The connector signs every API request automatically; no token exchange or session is required.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain ThreatConnect credentials
Obtain the required credentials (url, accessId, secretKey) from your ThreatConnect administrator or the ThreatConnect admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Group
| Source Field Name | SDM Attribute |
|---|---|
| sync time | Last captured |
GroupResource.assignments[].user.userName | Assigned to |
GroupResource.body | Body |
GroupResource.createdBy.userName | Created by |
GroupResource.dateAdded | Source created date |
GroupResource.documentDateAdded | Document date added |
GroupResource.documentType | Document type |
GroupResource.dueDate | Due date |
GroupResource.escalated | Escalated |
GroupResource.escalationDate | Escalation date |
GroupResource.eventDate | Event date |
GroupResource.fileName | File name |
GroupResource.fileSize | File size |
GroupResource.fileText | File text |
GroupResource.fileType | File type |
GroupResource.firstSeen | First seen |
GroupResource.from | From |
GroupResource.header | Header |
GroupResource.id | UID |
GroupResource.lastModified | Source last modified |
GroupResource.name | Name |
GroupResource.overdue | Overdue |
GroupResource.ownerName | Owner |
GroupResource.password | Password |
GroupResource.publishDate | Published date |
GroupResource.reminded | Reminded |
GroupResource.reminderDate | Reminder date |
GroupResource.signatureDateAdded | Signature date added |
GroupResource.status | Group status |
GroupResource.subject | Subject |
GroupResource.type | Group type |
GroupResource.webLink | URL |
GroupResource.xid | Xid |
Indicator
| Source Field Name | SDM Attribute |
|---|---|
| sync time | Last captured |
IndicatorResource.active | Active |
IndicatorResource.activeLocked | Active locked |
IndicatorResource.address | Address |
IndicatorResource.asNumber | AS number |
IndicatorResource.associatedGroups[].id | Group IDs |
IndicatorResource.block | Block |
IndicatorResource.confidence | Confidence |
IndicatorResource.dateAdded | Source created date |
IndicatorResource.description | Description |
IndicatorResource.dnsActive | DNS active |
IndicatorResource.hashtag | Hashtag |
IndicatorResource.hostName | Host name |
IndicatorResource.id | UID |
IndicatorResource.ip | IP |
IndicatorResource.keyName | Key name |
IndicatorResource.lastModified | Source last modified |
IndicatorResource.md5 | MD5 |
IndicatorResource.mutex | Mutex |
IndicatorResource.ownerName | Owner |
IndicatorResource.privateFlag | Private flag |
IndicatorResource.rating | Rating |
IndicatorResource.sha1 | SHA1 |
IndicatorResource.sha256 | SHA256 |
IndicatorResource.size | Size |
IndicatorResource.source | Source |
IndicatorResource.subject | Subject |
IndicatorResource.summary | Summary |
IndicatorResource.text | Text |
IndicatorResource.threatAssessConfidence | Threat assess confidence |
IndicatorResource.threatAssessRating | Threat assess rating |
IndicatorResource.threatAssessScore | Threat assess score |
IndicatorResource.type | Type |
IndicatorResource.userAgentString | User agent |
IndicatorResource.valueName | Value name |
IndicatorResource.valueType | Value type |
IndicatorResource.webLink | URL |
IndicatorResource.whoisActive | Who is active |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Group
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastModified.
API
- Type: REST endpoint · Endpoint:
GET /api/v3/groups - Default filters:
fields=tags,fields=attributes,fields=securityLabels; incremental syncs add TQLlastModified GT '<since>'
Indicator
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastModified.
API
- Type: REST endpoint · Endpoint:
GET /api/v3/indicators - Default filters:
fields=tags,fields=attributes,fields=securityLabels,fields=associatedGroups,fields=threatAssess; incremental syncs add TQLlastModified GT '<since>'
Changelog
The ThreatConnect connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.0 | Improvements - Upgraded to the latest Brinqa connector framework, modernizing how ThreatConnect groups and indicators are modeled and synchronized. - Indicator records now include their associated group IDs and ThreatAssess rating, confidence, and score, which were not previously retrieved from ThreatConnect. - Date fields (date added, last modified, first seen, event date, due/escalation/reminder dates, publish date, etc.) are now stored as proper timestamps rather than raw numbers, improving filtering and reporting. Bug Fixes - Group and indicator synchronization no longer fails when ThreatConnect returns a user record without an identifier (for example, on a group's "created by" or an indicator's associated groups). | • Group and Indicator: the attribute model has changed (date fields are now timestamps, the attribute set has been updated, and additional indicator data is captured). Re-sync both object types after upgrading so existing records pick up the new structure. |