ThreatQuotient ThreatQ Integration

Document created by Christine Tran Employee on Nov 1, 2018Last modified by Susan Read-Miller on Nov 27, 2018
Version 8Show Document
  • View in full screen mode

ThreatQuotient Logo

ThreatQuotient™ delivers an open and extensible threat intelligence platform (TIP) to provide defenders the context, customization and collaboration needed for increased security effectiveness and efficient threat operations and management. ThreatQ™ accelerates the transformation of threat data into actionable threat intelligence by giving defenders unmatched control through a Threat Library™, an Adaptive Workbench™ and an Open Exchange™ to ensure that intelligence is accurate, relevant and timely to their business. With ThreatQ, customers can get more out of existing security resources, both people and infrastructure. 

 

The integration between RSA Archer and ThreatQ simplifies the exchange of information between the two platforms in either direction without having a user in either system copying and pasting data from one platform to the other. This integration will enable RSA Archer users remain within the interface and update RSA Archer with thret intelligence information from ThreatQ. Additionally, users of ThreatQ can pass information on to Archer seamlessly where action and assignment to other groups to map to an organization’s operational workflow all while maintaining a history of work done.

 

Integration Features

ThreatQuotient integration with RSA Archer enables organizations to:

  • Enrich an artifact with context from ThreatQ to more accurately understand Incident response tasks
  • Create an associated event in ThreatQ from an Incident to use that incident's context in ThreatQ and inform the Self Tuning Library
  • Update a pre-existing Event associated with an Incident to keep the IoC relationships and context up to date for scoring purposes
  • Allow a subset of incidents to be automatically created and synchronized against a TQ Event Type to use the incidents context in ThreatQ
  • Automatically update an associated incident when an Event is modified to reduce overall work on analysts

 

Solution and Platform Information

 

For More Information

To learn more about the ThreatQuotient RSA Ready certified integration, review the Implementation Guide.

 

For Additional Support

To learn more about ThreatQuotient, please contact Sales@ThreatQ.com or 703.574.9885. For technical support questions, please contact Sales@ThreatQ.com or 703.574.9885.

Attachments

    Outcomes