ThreatRecall sits next to your stack.
It does not replace it.

# Minimal config: pull from an OpenCTI workspace via STIX 2.1 API
# Replace with your OpenCTI instance URL and API token

curl -X POST https://app.threatrecall.ai/api/ingest/stix \\
  -H "Authorization: Bearer $THREATRECALL_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "source": "opencti",
    "source_url": "https://opencti.internal.example.com",
    "stix_bundle_url": "https://opencti.internal.example.com/bundles/export/global/stix2/1/simple",
    "auth_header": "Authorization: Bearer YOUR_OPENCTI_TOKEN"
  }'

# ThreatRecall fetches the STIX bundle and ingests as KG nodes.
# Duplicate nodes are detected by STIX id — safe to re-run.
# Docs: /docs/api (OpenCTI section)

# props.conf — index events containing IOCs
# Add to $SPLUNK_HOME/etc/system/local/props.conf

[source::...threat_intel_feed]
TRANSFORMS-threatrecall = threatrecall_ioc_forward

# outputs.conf — send to ThreatRecall ingest endpoint
# Add to $SPLUNK_HOME/etc/system/local/outputs.conf

[tcpout:threatrecall]
server = app.threatrecall.ai:443
sslCertCA = /opt/splunk/etc/auth/splunkcloud/secureAAA.crt

# transforms.conf — filter and shape events
# Add to $SPLUNK_HOME/etc/system/local/transforms.conf

[threatrecall_ioc_forward]
REGEX = (?i)(ioc|indicator|malware|apt)
DEST_KEY = _JSON
FORMAT = json_events = true

# Or use a scripted alert in Splunk — run every 5 min:
# $SPLUNK_HOME/bin/scripts/threatrecall_hec.py

curl -X POST https://app.threatrecall.ai/api/ingest/bulk \\
  -H "Authorization: Bearer $THREATRECALL_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d "{\"source\":\"splunk_hec\",\"events\": $(cat /tmp/splunk_notables.json)}"

# MISP feed configuration (Admin → Feeds → Add feed)

# Feed URL (replace with your internal MISP URL):
https://misp.internal.example.com/feeds/download

# Authentication headers:
Authorization: Bearer <YOUR_MISP_AUTH_KEY>
X-MISP-Org: YourOrg

# Sync settings:
Fixed server: https://app.threatrecall.ai/api/ingest/misp
Sync interval: 60 min (configurable, 15min–24h)
Filter tags: +threat-intel,-false-positive,-osint-auto

# Alternatively, push via MISP event publish hook:
# /usr/local/bin/misp2threatrecall.py --misp-url https://misp.internal
# Run via cron: */15 * * * * /usr/local/bin/misp2threatrecall.py

curl -X POST https://app.threatrecall.ai/api/ingest/misp \\
  -H "Authorization: Bearer $THREATRECALL_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"feed_id": "misp-ransomware-feed", "event_ids": []}'
# Empty event_ids = ingest last 24h of events matching feed filters

# Logic App trigger: "When an Azure Sentinel incident is created"

# Step 1: Parse incident title for the recall query
TriggerBody()?['Title']

# Step 2: HTTP action → ThreatRecall recall endpoint

POST https://app.threatrecall.ai/api/recall
Headers:
  Authorization: Bearer <THREATRECALL_API_KEY>
  Content-Type: application/json

Body:
{
  "query": "@{triggerBody()?['Title']}",
  "max_results": 3,
  "tlp_filter": ["GREEN", "AMBER", "WHITE"]
}

# Step 3: Parse response → add incident comment
# Azure Sentinel: Add comment to incident
Incident Client:
  Incident ARM ID: @{triggerBody()?['ResourceId']}
Comment:
  ThreatRecall Analysis:
  @{body('ThreatRecall_Recall')?['results']?['name']}
  Confidence: @{body('ThreatRecall_Recall')?['results']?['confidence']}
  TLP: @{body('ThreatRecall_Recall')?['results']?['tlp']}
  Source: @{body('ThreatRecall_Recall')?['results']?['source']}

# Error handling: if recall returns empty, skip comment (no-op)

# Planned: push ThreatRecall STIX export to Chronicle Ingestion API
# Chronicle STIX 2.1 endpoint (target design — subject to change):

curl -X POST https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate \\
  -H "Authorization: Bearer $CHRONICLE_OAUTH_TOKEN" \\
  -H "Content-Type: application/json" \\
  -d "$(curl -sS https://app.threatrecall.ai/api/recall/sessions/<RECALL_ID>/export.stix \\
    -H 'Authorization: Bearer '$THREATRECALL_API_KEY \\
    | python3 -c 'import sys,json; d=json.load(sys.stdin); print(json.dumps({"entries":[{"logText":json.dumps(d),"collectionTime":"'"$(date -u +%FT%TZ)"'"}],"log_type":"STIX"}))' \\
  )"

# Until Q3 2026: use the generic STIX export → manual Chronicle import.
# Flag in your pilot application to get early access.

# On request: pull adversary actors from Falcon Intel API
# Requires FALCON_CLIENT_ID + FALCON_CLIENT_SECRET (Falcon OAuth2)

# Step 1: Get OAuth2 token
TOKEN=$(curl -s -X POST https://api.crowdstrike.com/oauth2/token \\
  -d "client_id=$FALCON_CLIENT_ID&client_secret=$FALCON_CLIENT_SECRET" \\
  | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

# Step 2: Pull actor objects and forward to ThreatRecall ingest
# (connector provided during pilot onboarding)
curl -s "https://api.crowdstrike.com/intel/v1/actors?limit=100&fields=id,name,description,motivations,kill_chain" \\
  -H "Authorization: Bearer $TOKEN" | \\
curl -X POST https://app.threatrecall.ai/api/ingest/crowdstrike \\
  -H "Authorization: Bearer $THREATRECALL_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d @-

# /api/ingest/crowdstrike endpoint ships with pilot connector package.

# Step 1: In TheHive → Administration → Webhooks, add:
# URL: https://app.threatrecall.ai/api/ingest/thehive
# Authentication: Add Authorization header with your ThreatRecall API key

# TheHive sends this JSON payload on case:create / observable:create events:
{
  "operation": "Creation",
  "objectType": "Observable",
  "objectId": "~12345",
  "object": {
    "dataType": "domain",
    "data": "malicious-domain.example.com",
    "tlp": 2,
    "ioc": true,
    "tags": ["apt29", "supply-chain"]
  },
  "details": {
    "caseId": "~67890",
    "title": "APT29 Phishing Campaign"
  }
}

# Step 2: ThreatRecall ingests the observable as a KG node (type: ioc).
# TLP 0=WHITE, 1=GREEN, 2=AMBER, 3=RED — mapped to ThreatRecall TLP fields.

# Step 3: ThreatRecall POSTs recall enrichment back to TheHive case:
PATCH https://thehive.internal.example.com/api/v1/case/~67890/customField
{
  "threatrecall_context": {
    "recall_result": "APT29 actor node matched. Confidence: 0.92. TLP: AMBER.",
    "recall_id": "uuid-here",
    "recall_ts": "2026-05-29T21:00:00Z"
  }
}