Configure ThreatConnect Integration
Administrators can integrate Collaborate with ThreatConnect to publish alerts to ThreatConnect using webhook for comprehensive threat analysis.
Before you Start
Ensure that you have the View and Create permissions for the ThreatConnect module.
Ensure that you have the incoming webhook URL, username, and the password of your ThreatConnect account.
Steps
To integrate Collaborate with ThreatConnect, follow these steps:
Go to Administration > Integrations > Third Party Integrations > ThreatConnect.
To configure the integration for the first time, click Configure, or to edit an existing integration, click Edit, and follow these steps:
Integration Name: Enter the name of the integration. For example, Collaborate ThreatConnect Integration.
Webhook URL: Enter the webhook URL from ThreatConnect.
Username: Enter the username for your ThreatConnect account.
Password: Enter the password for your ThreatConnect account.
Test Connection: Click Test Connection to check the connectivity between Collaborate and ThreatConnect.
Status (Optional): Turn on this toggle to activate the integration. By default, this is turned on.
Publish Automated Alerts (Optional): Turn on this toggle to auto-publish alerts from RSS, Cyware, and Network advisories to ThreatConnect. If automatic publishing of alerts from RFI or Intel submissions is enabled in Configurations, those alerts will also be automatically published to ThreatConnect. For more information about enabling direct submissions, see Configure Member Submission Preferences. By default, this is turned off.
Click Configure.
You can now post alerts to ThreatConnect while creating alerts. For more information, see Post Alert to Other Applications.