AiStrike Documentation
AiStrike Documentation
Breadcrumbs

ThreatConnect

Overview

This document describes how to configure ThreatConnect to integrate with AiStrike. By creating and configuring an API User in ThreatConnect, you can obtain the API Access ID, Secret Key, or API Token required for secure communication between ThreatConnect and AiStrike.◼︎

Prerequisites

  • Administrator access to ThreatConnect Organization Settings.

  • An AiStrike tenant ready to accept API-based threat intelligence ingestion.

  • Network connectivity between AiStrike and ThreatConnect API endpoints.

Step 1: Navigate to Organization Settings

  1. Log in to your ThreatConnect Console.

  2. Hover over Settings in the top navigation bar.

  3. Select Org Settings.

  4. On the Membership tab, click Create API User.

Step 2: Create an API User

When creating the API user, complete the following fields:

  • First Name / Last Name — Provide identifiable details for the API user (example: AiStrike / Integration).

  • System Role — Choose the role based on your needs:

    • Api User → Can use all ThreatConnect v2 and v3 API endpoints (except v3 Exchange Admin endpoints).

    • Exchange Admin → Full API access including v3 Exchange endpoints.

Note: The System Role dropdown appears only if your current user has Operations Administrator or Administrator role. Otherwise, the API User will default to Api User.

  • Organization Role — Assign the user's role within your organization (example: Standard User).

  • Token Expiration (days) (Optional) — Specify how long the API token should remain valid.

  • Disabled — Leave this unchecked unless you are deactivating the user later.

  • Include in Observations and False Positives (Optional) — Check this to allow data from the API user to count toward observation and false-positive metrics.

  • Allow User to Exceed API Link Limit (Optional) — Check this to override default API association limits.

  • Custom TQL Timeout (Optional) — Set a custom query timeout (in ms) for ThreatConnect Query Language requests.

Step 3: Save and Generate Authentication

Choose one of the following authentication methods:

  • Access ID + Secret Key Authentication

    • Record the Secret Key immediately. It will not be accessible once the setup window is closed.

    • Click Save to create the account.

  • API Token Authentication

    • If using token-based authentication, click Save User and Generate Token.

    • ThreatConnect will generate a token based on the expiration settings.

Step 4: Configure in AiStrike

  1. In your AiStrike Console, navigate to Integrations → ThreatConnect.

  2. Enter the following details:

    • API URL: https://<your-threatconnect-instance>/api

    • API Access ID and Secret Key

    • Organization Name (Default API Organization)

  3. Save and test the connection.

Verification

Run a basic request from AiStrike using your ThreatConnect credentials:

GET /api/v3/victims HTTP/1.1
Host: <your-threatconnect-instance>
Authorization: TC-Token <your-api-token>
Content-Type: application/json

Expected Result: You should receive a JSON response listing victims or an empty dataset, confirming that the connection is valid.