diff --git a/anomali_threatstream/assets/account_config.json b/anomali_threatstream/assets/account_config.json
new file mode 100644
index 0000000000000..fab4de8614de1
--- /dev/null
+++ b/anomali_threatstream/assets/account_config.json
@@ -0,0 +1,64 @@
+{
+  "supported_auth_methods": [],
+  "additional_config_fields": [
+    {
+      "key": "api_domain",
+      "label": "Domain",
+      "editable": true,
+      "required": true,
+      "domain": {
+        "pattern": "^(?:[a-zA-Z0-9-]+\\.)*threatstream\\.com$"
+      }
+    },
+    {
+      "key": "email",
+      "label": "Email",
+      "editable": true,
+      "required": true,
+      "text": {}
+    },
+    {
+      "key": "api_key",
+      "label": "API Key",
+      "editable": true,
+      "required": true,
+      "password": {}
+    },
+    {
+      "key": "domain_risk_enabled",
+      "label": "Collect Domain Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream domain indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    },
+    {
+      "key": "ip_risk_enabled",
+      "label": "Collect IP Address Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream ip address indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    },
+    {
+      "key": "hash_risk_enabled",
+      "label": "Collect hash SHA256 Indicators (Threat Intel Feed)",
+      "help": "Enrich logs with Anomali ThreatStream hash SHA256 indicators data",
+      "editable": true,
+      "required": false,
+      "checkbox": {
+        "default": true
+      }
+    }
+  ],
+  "dataflow_config": [
+    {
+      "dataflow_id": "anomali-threatstream-threat-intel-feed",
+      "additional_config_fields": []
+    }
+  ]
+}