ThreatQuotient™ delivers an open and extensible threat intelligence platform (TIP) to provide defenders the context, customization and collaboration needed for increased security effectiveness and efficient threat operations and management. ThreatQ™ accelerates the transformation of threat data into actionable threat intelligence by giving defenders unmatched control through a Threat Library™, an Adaptive Workbench™ and an Open Exchange™ to ensure that intelligence is accurate, relevant and timely to their business. With ThreatQ, customers can get more out of existing security resources, both people and infrastructure.
The integration between RSA Archer and ThreatQ simplifies the exchange of information between the two platforms in either direction without having a user in either system copying and pasting data from one platform to the other. This integration will enable RSA Archer users remain within the interface and update RSA Archer with thret intelligence information from ThreatQ. Additionally, users of ThreatQ can pass information on to Archer seamlessly where action and assignment to other groups to map to an organization’s operational workflow all while maintaining a history of work done.
ThreatQuotient integration with RSA Archer enables organizations to:
- Enrich an artifact with context from ThreatQ to more accurately understand Incident response tasks
- Create an associated event in ThreatQ from an Incident to use that incident's context in ThreatQ and inform the Self Tuning Library
- Update a pre-existing Event associated with an Incident to keep the IoC relationships and context up to date for scoring purposes
- Allow a subset of incidents to be automatically created and synchronized against a TQ Event Type to use the incidents context in ThreatQ
- Automatically update an associated incident when an Event is modified to reduce overall work on analysts
Solution and Platform Information
- Solution Area:
- Impacted Use Cases: RSA Archer Cyber Incident & Breach Response
- Supported Platform Version: This offering has been validated on RSA Archer Platform release 6.2.
For More Information
To learn more about the ThreatQuotient RSA Ready certified integration, review the Implementation Guide.