How to connect to CQ Threat Intelligence
Navigate to Settings
You must be logged in to the CYBERQUEST web interface with a user with administrative rights.
Navigate to "Settings > Management > Data Source Manager".
This page contains all the data sources added in the CYBERQUEST application.
Complete the form
Press the "Add data-source" button and complete de following form:
DataSource Type: Select "CQApi/Cyberquest Threat Intelligence (LogName:CQTI)" data source;
DataSource Information: This field is filled in automatically with data source information;
Query Interval: At what time interval is the WMI query executed. It is automatically completed to run every 60 seconds;
Credentials to use: Add appropriate credentials from a drop-down list;
Tag: This field is filled in automatically, but you can change the information;
Administrative Notes: You can complete with information about the added data source;
Annonymize Fields: You can select certain information to be anonymized;
Script: You can edit the data in this script;
Click the "Save" button to save the data source.
Assign the CYBERQUEST agent
The next step is to assign the CYBERQUEST agent to this data source. Press the drop-down list and choose the agent.
To edit the data sources information, press "Edit" button. This process is almost identical to adding data sources.
Bulk Clone : Clone the current data source settings for each element of the field “Bulk Clone”.
Clone : Clone the data source.
You can also delete the data source by pressing "Delete" button. To delete data source you must remove Agent from data source.