Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
ThreatStack - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="threat-stack-jupiterone-integration-benefits">Threat Stack + JupiterOne Integration Benefits</h2> <ul><li>Visualize Threat Stack agents in the JupiterOne graph.</li> <li><p>Map Threat Stack agents to aws instances or servers they protect in your<br> JupiterOne account.</p></li> <li><p>Map Threat Stack agents to cves they identify in your JupiterOne</p></li> <li>Monitor changes to Threat Stack agents using JupiterOne alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li>JupiterOne periodically fetches Threat Stack agents to update the graph.</li> <li>Write JupiterOne queries to review and monitor updates to the graph.</li> <li>Configure alerts to take action when the JupiterOne graph changes.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne requires the name and id of your Threat Stack organization.<br> JupiterOne also requires the user id and API key of a configured application<br> key.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-threat-stack">In Threat Stack</h3> <p>The integration instance configuration requires the following parameters for API<br> authentication:</p> <p>Go to <strong>Settings > Application Keys</strong> from the web console of your Threat Stack<br> account, then find the following values under <strong>REST API Key</strong>, copy/paste each<br> of them into your integration configuration screen in JupiterOne.</p> <ul><li><strong>Organization Name</strong> (<code class="code codeInline" spellcheck="false" tabindex="0">orgName</code>)</li> <li><strong>Organization ID</strong> (<code class="code codeInline" spellcheck="false" tabindex="0">orgId</code>)</li> <li><strong>User ID</strong> (<code class="code codeInline" spellcheck="false" tabindex="0">userId</code>)</li> <li><strong>API Key</strong> (<code class="code codeInline" spellcheck="false" tabindex="0">apiKey</code>)</li> </ul><h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Threat Stack</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Threat Stack<br> account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>Organization Name</strong> of your Threat Stack account.</p></li> <li>Enter the <strong>Organization ID</strong> of your Threat Stack account.</li> <li>Enter the <strong>User ID</strong> configured for API access.</li> <li>Enter the <strong>API Key</strong> configured for API access.</li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Threat Stack</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entity resources are ingested when the integration runs:</p> <table><thead><tr><th>Example Entity Resource</th> <th>_type : _class of the Entity</th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_account</code> : <code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Threat Stack Agent</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_agent</code> : <code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created/mapped:</p> <table><thead><tr><th>Relationships</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_account</code> <strong>HAS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">threatstack_agent</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_agent</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_agent</code> <strong>PROTECTS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">server</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">threatstack_agent</code> <strong>IDENTIFIED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">cve</code></td> </tr></tbody></table> </article> </main>
.png)