How to Update ThreatLink via the UseCase Library

Upgrading ThreatLink: A Step-by-Step Guide

Follow these simple steps to upgrade your ThreatLink environment:

1. Install the Latest Version:

• Head over to the SOAR use case library.

• Locate the newest ThreatLink version and install it.

• During the installation, make sure to configure the necessary connections.

• DO NOT start the new playbook stream.

2. Import Case Settings:

• Go to "Settings."

• Select "Case Settings."

• Choose "General."

• Click "Import" and import the provided Case Setting JSON file from the top of this page.

3. Update the Case Template:

• Open the Case Template.

• Add two new tabs: "Alert Queries" and "System Fields."

• Populate these tabs with the associated fields (refer to the screenshot provided).
  
  

  Open

  

4. (MSSP Instances Only) Set Up Child Domain Integrations:

• If you're upgrading an MSSP instance with alerting in child domains, you'll need to set up new Devo integration connections.

• Use the alert API for each child domain.

• Make a note of the connection names for each child domain.

5. (MSSP Instances Only) Configure Domain Connection List:

• Open the "Domain Connection Custom List."

• Map each child domain to its corresponding connection name.
  
  

  Open

  

6. Activate the New Version:

• Pause the old ThreatLink streams.

• Start the new playbook streams.

That's it! You've successfully upgraded your ThreatLink environment.