# ThreatQuotient Integration needs updating

**URL:** <https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390>\
**Category:** Elasticsearch\
**Tags:** integrations\
**Created:** [August 4, 2022, 9:30am UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390 "2022-08-04T09:30:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\
**Post date:** [August 4, 2022, 9:30am UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390/1 "2022-08-04T09:30:03Z")

</div>

The current integration still requires the old means of authenticating with the TIP server using Oauth2 Client ID and Oauth2 Client Secret which need to be generated via CLI commands, while these days they have switched to a combination of user account and API token, which are generated via the web UI, So it is preferrable that you make this switch.

---

<div class="post-metadata">

**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\
**Post date:** [August 4, 2022, 9:50am UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390/2 "2022-08-04T09:50:21Z")

</div>

Thanks for reporting this @frederikvandeputte, I've just created an issue in our integrations repo to track: [Threat Quotient | Authentication · Issue #3954 · elastic/integrations · GitHub](https://github.com/elastic/integrations/issues/3954)

I can't seem to locate ThreatQ documentation to walkthrough the steps to generate an API token. Would you be able to share, if you have some relevant docs?

---

<div class="post-metadata">

**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\
**Post date:** [August 4, 2022, 11:46am UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390/3 "2022-08-04T11:46:25Z")

</div>

The actual documentation is as far as I know not publicly available, but there are some posts that can be found that address this very issue:  
[https://www.threatq.com/threatq-open-exchange-api/](https://www.threatq.com/threatq-open-exchange-api/) and [https://www.threatq.com/api-part-2/](https://www.threatq.com/api-part-2/) Maybe, this will get you started.

---

<div class="post-metadata">

**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\
**Post date:** [August 4, 2022, 12:02pm UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390/4 "2022-08-04T12:02:50Z")

</div>

When a user is added an authentication token is automatically generated for this user.  
The account requires to have an email address as well.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea148b2ac502cae140e673342e6c049c4e1c7910.png)  
When authenticating with the API a combination of Token, email address and password is used:

> Blockquote

## Authentication

ThreatQ uses OAuth 2.0 to authenticate end users. You must have a ThreatQ user account to retrieve an api token. The api token is required for all api requests. The token does time out; therefore, you must periodically refresh the token.

### AUTHORIZATION WORKFLOW

1. Run a GET request to retrieve your client ID using the following format: https:// **hostname** /assets/js/config.js
2. Run a POST/token request to retrieve your authorization access token. See POST/token in the Authorization section of this reference for the correct format.Include the following parameters:

- grant\_type (password)
- client-id (retrieved in step 1) **Example:** https:// **hostname** /api/token?grant\_type=password&client\_id=ab20a55dd9ac779246210d7102a45ee37In the request body, include your ThreatQ credentials:
- email
- password

1. Enter the access token as the authorization key in the header for all subsequent api requests.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2022, 12:03pm UTC](https://discuss.elastic.co/t/threatquotient-integration-needs-updating/311390/5 "2022-09-01T12:03:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.