ThreatExchange UI Overview

ThreatExchange UI Use Cases

What you can do with ThreatExchange. See the ThreatExchange API Reference for a comprehensive list of the ThreatExchange APIs and the related endpoints. In this doc, we focus on the most basic subset.

People at various organizations want to share information about threats: malware signatures, malicious URLs, and so on.
A threat indicator is the objective part: a file hash, a URL, and so on, with a type (MD5, SHA1, URL, and so on).
A threat descriptor contains an indicator and the subjective parts: how malicious a team thinks it is, when they first saw it, and so on.
Meta privacy revolves around user IDs, ThreatExchange revolves around app IDs. For example, app ID 1064060413755420 is Media Hash Sharing Test. These are generally of the form Team T at company C.
When people share threat data, they can specify who they want to see each datum. This is referred to as a visibility or privacy type.
- Visible/public means all ThreatExchange members can see it.
- Or, for each datum the members can create an app-whitelist of specific teams at specific companies.
- Or, for each datum the members can specify a privacy-group that is simply a predefined list of app IDs.
People can tag their descriptors. These are tags in any other tool, except that ThreatExchange tags have their own metadata, including the subjective parts that descriptors have, and they also have their own visiblity (public/app-whitelist/privacy-group).
There's more about threat descriptors (review status and others) and other types of data shareable on ThreatExchange (malware analyses, malware families, and others). For the purpose of this walkthrough, we're focused on indicators, descriptors, visibility, and tags.

Find the UI

Navigate to https://developers.facebook.com/apps and select your app:

Then, find the ThreatExchange product within the navbar on the left:

Add Team Members

Navigate to https://developers.facebook.com/apps and select your app.
Select Roles > Roles.
Add teammate roles as Administrators or Developers. Note: Do not add teammates as Test Users or Analytics Users. These roles have no meaning for ThreatExchange apps.
If your organization has a ThreatExchange app ID, but the assigned administrators/developers have since left your organization, please contact us at threatexchange@meta.com so that we can reset an admin to be a current employee of your organization. From there, you'll be able to self-service add everyone else in your organization.