diff --git a/packages/ti_threatq/changelog.yml b/packages/ti_threatq/changelog.yml
index 27483c4b028..5a976ffb0d0 100644
--- a/packages/ti_threatq/changelog.yml
+++ b/packages/ti_threatq/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.39.2"
+  changes:
+    - description: Restores `sources` & `attributes` fields after recent updates to the ThreatQ Platform's API.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20042
 - version: "1.39.1"
   changes:
     - description: Fix transform destination to use keyword for data_stream.namespace, allowing multi-namespace deployments.
diff --git a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs
index 296d8045927..67509d3eb3f 100644
--- a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs
+++ b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs
@@ -30,6 +30,9 @@ request.transforms:
 - set:
     target: url.params.limit
     value: {{page_size}}
+- set:
+    target: url.params.fields
+    value: '{{threat_library_fields}}'
 - set:
     target: url.params.cursorMark
     value: '[[.cursor.cursor_mark]]'
diff --git a/packages/ti_threatq/data_stream/threat/manifest.yml b/packages/ti_threatq/data_stream/threat/manifest.yml
index 57388e7cccc..f0bace75ffa 100644
--- a/packages/ti_threatq/data_stream/threat/manifest.yml
+++ b/packages/ti_threatq/data_stream/threat/manifest.yml
@@ -95,6 +95,17 @@ streams:
         show_user: false
         title: Page size
         description: Maximum number of records to pull in one request. The maximum supported page size value is 1000.
+      - name: threat_library_fields
+        type: text
+        title: Threat Library Fields
+        multi: false
+        required: true
+        show_user: true
+        default: "*,sources,attributes,attributes.name,attributes.value"
+        description: >-
+          Comma-separated list of fields to retrieve from the Threat Library.
+          An asterisk (*) can be used to retrieve all default fields. In ThreatQ v6.12 and later,
+          sources & attributes are no longer part of the default fields and must be explicitly requested.
       - name: ssl
         type: yaml
         title: SSL Configuration
diff --git a/packages/ti_threatq/manifest.yml b/packages/ti_threatq/manifest.yml
index aa8f7b965d4..a38795c703c 100644
--- a/packages/ti_threatq/manifest.yml
+++ b/packages/ti_threatq/manifest.yml
@@ -1,6 +1,6 @@
 name: ti_threatq
 title: ThreatQuotient
-version: "1.39.1"
+version: "1.39.2"
 description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent.
 type: integration
 format_version: "3.3.1"