From 2bd59ca8dfd1e7738aed68052699867696e5c8e6 Mon Sep 17 00:00:00 2001 From: Zach Shames Date: Wed, 8 Jul 2026 10:19:57 -0400 Subject: [PATCH 1/5] fix: issue pulling sources & attributes from ThreatQ --- .../data_stream/threat/agent/stream/httpjson.yml.hbs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs index 296d8045927..b062f02d1d4 100644 --- a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs +++ b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs @@ -30,6 +30,9 @@ request.transforms: - set: target: url.params.limit value: {{page_size}} +- set: + target: url.params.fields + value: "*,sources,attributes,attributes.name,attributes.value" - set: target: url.params.cursorMark value: '[[.cursor.cursor_mark]]' From 403e2b0b68ee23d744d247ce6a025b28acec5789 Mon Sep 17 00:00:00 2001 From: Zach Shames Date: Wed, 8 Jul 2026 10:28:37 -0400 Subject: [PATCH 2/5] chore: manifest & changelog updates --- packages/ti_threatq/changelog.yml | 5 +++++ packages/ti_threatq/manifest.yml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/ti_threatq/changelog.yml b/packages/ti_threatq/changelog.yml index 27483c4b028..4190ab427cf 100644 --- a/packages/ti_threatq/changelog.yml +++ b/packages/ti_threatq/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.39.2" + changes: + - description: Restores `sources` & `attributes` fields after recent updates to the ThreatQ Platform's API. + type: bugfix + link: https://github.com/elastic/integrations/pull/20040 - version: "1.39.1" changes: - description: Fix transform destination to use keyword for data_stream.namespace, allowing multi-namespace deployments. diff --git a/packages/ti_threatq/manifest.yml b/packages/ti_threatq/manifest.yml index aa8f7b965d4..a38795c703c 100644 --- a/packages/ti_threatq/manifest.yml +++ b/packages/ti_threatq/manifest.yml @@ -1,6 +1,6 @@ name: ti_threatq title: ThreatQuotient -version: "1.39.1" +version: "1.39.2" description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent. type: integration format_version: "3.3.1" From 34b757efd9400bfd828bba043fd7ca4edd837379 Mon Sep 17 00:00:00 2001 From: Zach Shames Date: Wed, 8 Jul 2026 10:34:46 -0400 Subject: [PATCH 3/5] fix: user-specified threat library fields --- .../data_stream/threat/agent/stream/httpjson.yml.hbs | 2 +- packages/ti_threatq/data_stream/threat/manifest.yml | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs index b062f02d1d4..3e2676c166d 100644 --- a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs +++ b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs @@ -32,7 +32,7 @@ request.transforms: value: {{page_size}} - set: target: url.params.fields - value: "*,sources,attributes,attributes.name,attributes.value" + value: {{threat_library_fields}} - set: target: url.params.cursorMark value: '[[.cursor.cursor_mark]]' diff --git a/packages/ti_threatq/data_stream/threat/manifest.yml b/packages/ti_threatq/data_stream/threat/manifest.yml index 57388e7cccc..f0bace75ffa 100644 --- a/packages/ti_threatq/data_stream/threat/manifest.yml +++ b/packages/ti_threatq/data_stream/threat/manifest.yml @@ -95,6 +95,17 @@ streams: show_user: false title: Page size description: Maximum number of records to pull in one request. The maximum supported page size value is 1000. + - name: threat_library_fields + type: text + title: Threat Library Fields + multi: false + required: true + show_user: true + default: "*,sources,attributes,attributes.name,attributes.value" + description: >- + Comma-separated list of fields to retrieve from the Threat Library. + An asterisk (*) can be used to retrieve all default fields. In ThreatQ v6.12 and later, + sources & attributes are no longer part of the default fields and must be explicitly requested. - name: ssl type: yaml title: SSL Configuration From aa6759b6b4fb16dc1a4573480d263ef65c1093f2 Mon Sep 17 00:00:00 2001 From: zach-threatq <46786812+zach-threatq@users.noreply.github.com> Date: Wed, 8 Jul 2026 10:39:00 -0400 Subject: [PATCH 4/5] fix: updates PR ID Updated the changelog to reflect the correct pull request link for version 1.39.2. --- packages/ti_threatq/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/ti_threatq/changelog.yml b/packages/ti_threatq/changelog.yml index 4190ab427cf..5a976ffb0d0 100644 --- a/packages/ti_threatq/changelog.yml +++ b/packages/ti_threatq/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Restores `sources` & `attributes` fields after recent updates to the ThreatQ Platform's API. type: bugfix - link: https://github.com/elastic/integrations/pull/20040 + link: https://github.com/elastic/integrations/pull/20042 - version: "1.39.1" changes: - description: Fix transform destination to use keyword for data_stream.namespace, allowing multi-namespace deployments. From 0123fc584cd777917c8bce407be099692a15b521 Mon Sep 17 00:00:00 2001 From: Zach Shames Date: Wed, 8 Jul 2026 12:25:21 -0400 Subject: [PATCH 5/5] fix: single-quote threat library fields placeholder --- .../ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs index 3e2676c166d..67509d3eb3f 100644 --- a/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs +++ b/packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs @@ -32,7 +32,7 @@ request.transforms: value: {{page_size}} - set: target: url.params.fields - value: {{threat_library_fields}} + value: '{{threat_library_fields}}' - set: target: url.params.cursorMark value: '[[.cursor.cursor_mark]]'