ThreatConnect is a security operations and analytics platform designed to allow teams to identify, manage, and block threats faster with intelligence. For more information about ThreatConnect please visit:
The Polarity ThreatConnect integration allows Polarity to search for address, file, host, and email indicators in ThreatConnect. The Polarity-ThreatConnect integrations includes interactive elements that allow Polarity user's to add and remove tags, modify the severity and confidence level of an indicator, and report false positives directly from the Polarity Overlay Window.
 |
 |
|---|---|
| ThreatAssess Details | Associcated Indicators View |
The URL of the ThreatConnect instance you would like to connect to (including http:// or https://). If you are running an internal instance of ThreatConnect on a non-default port, please specify the port here as well.
Account Identifier that is associated with the API Key
The API (secret) Key associated with the provided Access ID
If enabled, the integration will return indicators that are "inactive". Inactive indicators are not considered Indicators of Compromise and are kept for historical accuracy.
By default all organizations visible to the provided API User will be searched. This blocklist is a comma delimited list of organizations you do not want searched. This option cannot be used in conjunction with the "Organization Search Allowlist" option.
By default all organizations visible to the provided API User will be searched. This whitelist is a comma delimited list of organizations you want searched (organizations not listed will not be searched). This option cannot be used in conjunction with the "Organization Search Blocklist" option
Note that you cannot use both the Organization Search Allowlist and the Organization Search Blocklist.
Installation instructions for integrations are provided on the PolarityIO GitHub Page.
Polarity is a memory-augmentation platform that improves and accelerates analyst decision making. For more information about the Polarity platform please see: