Documentation on how ThreatQuotient handles the expiration of indicators: https://www.threatq.com/a-guide-to-indicator-expiration/.

Although the API documentatiton is not available without signing up, based on the above article, we can conclude that the feed collected provides information about the indicator being expired or not.

Currently, we only have 1 datastream threat that we support. This calls the API {{host}}/api/indicators/query/hash/{{data_collection_id}} with url parameter cursorMark.
Based on the sample logs for this datastream, the field that indicates expiration is ~~is assumed to be(must be confirmed with ThreatQ)~~ json.status.name in the raw document and threatq.attributes.status in the indexed document. The possible values are Active and Expired.

Approach:

Whenever the document comes in with threatq.attributes.status as Expired, we can add a new field expired_at with value now(). ~~Must be confirmed with ThreatQ if updated expired indicator is available via the API even with cursorMark URL parameter~~ This is updated whenever indicator is expired.
Use this field inside transform for retention policy with max_age as 1m so the expired indicator is immediately deleted in the destination index.

[TI_THREATQ] Add support for IOC expiration #7354

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions