How to connect to CQ Threat Intelligence

You must be logged in to the CYBERQUEST web interface with a user with administrative rights.

Navigate to "Settings > Management > Data Source Manager".

Alt text

This page contains all the data sources added in the CYBERQUEST application.

Alt text

Press the "Add data-source" button and complete de following form:

DataSource Type: Select "CQApi/Cyberquest Threat Intelligence (LogName:CQTI)" data source;

DataSource Information: This field is filled in automatically with data source information;

Query Interval: At what time interval is the WMI query executed. It is automatically completed to run every 60 seconds;

Credentials to use: Add appropriate credentials from a drop-down list;

Tag: This field is filled in automatically, but you can change the information;

Administrative Notes: You can complete with information about the added data source;

Annonymize Fields: You can select certain information to be anonymized;

Script: You can edit the data in this script;

Alt text

Click the "Save" button to save the data source.

The next step is to assign the CYBERQUEST agent to this data source. Press the drop-down list and choose the agent.

Alt text

To edit the data sources information, press "Edit" button Alt text . This process is almost identical to adding data sources.

Bulk Clone Alt Image : Clone the current data source settings for each element of the field “Bulk Clone”.

Clone Alt Image : Clone the data source.

You can also delete the data source by pressing "Delete" button. To delete data source you must remove Agent from data source.