ThreatQ Integration | Fixes Issue Pulling Sources & Attributes

packages/ti_threatq/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.39.2"
+  changes:
+    - description: Restores `sources` & `attributes` fields after recent updates to the ThreatQ Platform's API.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20042
 - version: "1.39.1"
   changes:
     - description: Fix transform destination to use keyword for data_stream.namespace, allowing multi-namespace deployments.

packages/ti_threatq/data_stream/threat/agent/stream/httpjson.yml.hbs

@@ -30,6 +30,9 @@ request.transforms:
 - set:
     target: url.params.limit
     value: {{page_size}}
+- set:
+    target: url.params.fields
+    value: '{{threat_library_fields}}'
 - set:
     target: url.params.cursorMark
     value: '[[.cursor.cursor_mark]]'

packages/ti_threatq/data_stream/threat/manifest.yml

@@ -95,6 +95,17 @@ streams:
         show_user: false
         title: Page size
         description: Maximum number of records to pull in one request. The maximum supported page size value is 1000.
+      - name: threat_library_fields
+        type: text
+        title: Threat Library Fields
+        multi: false
+        required: true
+        show_user: true
+        default: "*,sources,attributes,attributes.name,attributes.value"
+        description: >-
+          Comma-separated list of fields to retrieve from the Threat Library.
+          An asterisk (*) can be used to retrieve all default fields. In ThreatQ v6.12 and later,
+          sources & attributes are no longer part of the default fields and must be explicitly requested.
       - name: ssl
         type: yaml
         title: SSL Configuration

packages/ti_threatq/manifest.yml

@@ -1,6 +1,6 @@
 name: ti_threatq
 title: ThreatQuotient
-version: "1.39.1"
+version: "1.39.2"
 description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent.
 type: integration
 format_version: "3.3.1"