Configuring Feeds in the Threat Intelligence Platform

You must have Root scope to use this feature.

Use the Feeds tab on the System | Threat Intelligence Platform page (under Integrations) to configure and manage threat intelligence feeds.

To manage IoCs, see Managing IoCs in the Threat Intelligence Platform.

Using the Feeds Tab

The Feeds tab displays the threat intelligence feeds.

The Feeds table has the following columns:

• Icon—icon of the feed

• Name—name of the feed, such as PhishTank or etpro domain

• Type—type of feed:

  • Built-in feeds are provided by Stellar Cyber

  • Custom feeds (TAXII and TSV) are added using the Create button and then providing a collection URL and authentication credentials (see Adding Custom Feeds)

  • Premium feeds (Cybersixgill and Anomali ThreatStream) are provided by Stellar Cyber using credentials that you purchase (see Enabling Premium Feeds)

• Status—status of feed:

  • Success (green)—the feed successfully ran, when it periodically last ran

  • Error (red)—the feed failed when it last ran or the feed is in Stopped status

  • Disabled (white)—the feed is Disabled

• Status Message—status messages, such as:

  • Disabled—the feed is disabled

  • Success—the feed successfully produced IoCs in the latest running cycle (for Custom and Premium feeds only)

  • Initializing—the feed is initializing; this status is only displayed on the first run of the feed

  • Stopped—the feed has stopped working

  • Running—the feed is running (for Built-in feeds only)

  • Connection Error—the feed failed to establish a connection to the data source (for Custom and Premium feeds only)

• Enabled—toggle of the feed, either Enabled or Disabled

  • All Built-in, Custom, and Premium feeds can be Enabled and Disabled; when Enabled, IoCs are fetched and then stored locally; when Disabled, IoC ingestion stops

• Polling Frequency—frequency with which the data is updated from the feed, in hours

  • The Polling Frequency can be set for Custom and Premium feeds; for Built-in feeds, the Polling Frequency is 24 hours

• Retention Period—retention period of the feed, in days, after which feed data is deleted

• Backfill Days—number of backfill days. Backfilled data is information in the threat database from the past few days, with an upper limit of 30 days.

  • Whenever a feed is re-enabled, TIP fetches all IOCs that it has not fetched since the last time it was disabled, limited to a backfill buffer size

• Description—description of feed

  • Descriptions of Custom feeds can be edited; Descriptions of Built-in and Premium feeds are provided by Stellar Cyber and cannot be edited

• Last Ingestion—timestamp of the last ingestion update from the feed

• Actions—actions available on a feed, such as Delete this row, Edit this row, or Reset Premium Feed:

  • Custom and Premium feeds can be edited; Built-in feeds cannot be edited

  • Custom feeds can be deleted; Built-in and Premium feeds cannot be deleted

  • Only Premium feeds can be reset

Using Search

Use the Search box to search for information about a feed.

Using Columns

Disabling Feeds

Adding Custom Feeds

Custom feeds include TAXII and TSV. You configure custom feeds with credentials that you provide, for example, credentials for a TAXII server or credentials to access a TSV file. The TAXII version is 2.1.

You add Custom feeds by providing a Collection URL and entering basic HTTP authentication credentials such as Username and Password.

You can add up to 30 Custom feeds per organization.

Feeds may not work as expected if files are hosted on places where basic HTTP authentication is not allowed by default (for example, Amazon S3). Caution is advised.

When you add a TSV feed, an emerging_threat tag is added to all the IoCs brought in by that feed. Tags are displayed in the Tags column of the IoCs table.

For the rules and format of the TSV file, see TSV File Data Schema.

To add a custom feed:

1. Click Create.

   

2. The default Category is displayed, which is TAXII. Or select TSV.

   

3. Enter a Name. This is the name of the feed, which will be prepended with the Category, either TAXII or TSV.

4. Enter a Collection URL.

   1. For TAXII, enter a Collection URL. For details on how to obtain the TAXII collection URL, see Obtaining the TAXII Collection URL.

   2. For TSV, enter a URL to a TSV file.

5. Enter a Username and Password.

6. Select a Polling Frequency, in hours. This is how often the data is updated from the feed.

7. Select the number of Backfill Days, in days.

   The Backfill Days field is only available for TAXII feeds.

8. Select the Retention Period, in days, after which feed data is deleted. For details, see Retention Policy.

9. Enter a Description.

10. Click Submit.

    When the Custom feed is configured and enabled, the IoCs are fetched from the remote feed and stored locally.

Obtaining the TAXII Collection URL

The following example is for an AlienVault URL. The same format is used for other third-party providers that host TAXII servers.

The TAXII Collection URL does not support an alias for the TAXII collection name. Refer to the following procedure and use <collection ID>.

To set up a TAXII feed, obtain the TAXII collection URL as follows:

1. Do a cURL command from the AlienVault discovery URL:

   curl -k -X GET https://otx.alienvault.com/taxii/ -H "Accept: application/taxii+json; version=2.1" --user username:password

   This will produce something like the following:

   {"title": "Open Threat Exchange TAXII Server", "description": "Open Threat Exchange TAXII Server", "contact": "otx-support@alienvault.com", "default": "https://otx.alienvault.com/taxii/root", "api_roots": ["https://otx.alienvault.com/taxii/root"]}%

   The API root is https://otx.alienvault.com/taxii/root.

2. Add /collections to the API root, then do another cURL commands as follows:

   curl -k -X GET https://otx.alienvault.com/taxii/root/collections -H "Accept: application/taxii+json; version=2.1" --user username:password

   This will produce something like the following:

   {"collections": [{"id": "<collection ID>", "alias": "subscription", "title": "Your pulse subscription", "description": "Your pulse subscription", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}]}%

3. Add your <collection ID> to the previous URL, for example:

   https://otx.alienvault.com/taxii/root/collections/<collection ID>/

4. Use the collection URL to set up a TAXII feed in Adding Custom Feeds.

Enabling Premium Feeds

Premium feeds are provided by Stellar Cyber and include Cybersixgill and Anomali ThreatStream. You configure them with credentials that you purchase.

Premium feeds are disabled by default. You edit the Premium feed and provide authentication credentials such as Username and Password or API Key, then enable the feed.

To enable premium feeds:

• Enabling Cybersixgill Premium Feed

• Enabling Anomali Premium Feed

Resetting Premium Feeds

Editing Feeds

You can edit Custom and Premium feeds.

Click the Edit icon () on a row in the table. A sample EDIT CUSTOM FEED is as follows:

For Custom feeds, the Category cannot be changed. The other fields can be edited.

Click the Edit icon () on a row in the table. A sample EDIT PREMIUM FEED is as follows:

For Premium feeds, the Name and Description cannot be changed. The other fields can be edited.

Feed Descriptions

The following feeds are available, with their category and description.

Feed Name	Category	Description
AlienVault OTX	Built-in	The AlienVault OTX feed provides IoCs, including malicious IP addresses, domains, URLs, and hashes that can be used to detect and investigate cyber threats.
DHS	Built-in	The Department of Homeland Security (DHS) feed provides IP addresses, domains, URLs, and hashes. These IoCs help describe and identify potential cyber threats and incidents.
Emerging Threat Pro IP, Domain	Built-in	The Proofpoint Emerging Threat feed provides up-to-the minute IP address and domain reputation. It is the industry’s most timely and accurate source of threat intelligence.
Emerging Threat Pro Rules	Built-in	The Proofpoint Emerging Threat feed provides a ruleset for detecting advanced threats using existing network security appliances, such as network Intrusion Detection/Prevention systems (IDS/IPS).
PhishTank	Built-in	The Phishtank feed provides a database of known phishing URLs. It is a collaborative clearing house for data and information about phishing attacks and fraudulent websites.
Abuse.ch (urlhaus and SSL certs)	Built-in	The Abuse.ch feed shares malicious URLs and hashes that are being used for malware distribution, and contains information about SSL certificates that have been associated with malicious activities.
OpenPhish	Built-in	The OpenPhish feed focuses on phishing threats. It identifies zero-day phishing URLs and provides comprehensive, actionable, real-time threat intelligence.
Emerging Threat	Built-in	The Emerging Threat feed provides IP addresses, domains, URLs, and file hashes. Emerging Threat is a type of threat or risk that is newly identified, rapidly evolving, or gaining prominence.
Cybersixgill	Premium	You can subscribe to the Cybersixgill service by using TAXII 2.1 protocol. Cybersixgill covertly searches from clear, deep, and dark web sources, and offers Threat Intelligence data and their exposure to risk.
Anomali	Premium	You can subscribe to the Anomali ThreatStream feed using your own username and API token. Anomali ThreatStream helps to aggregate, correlate, and analyze threat intelligence data from various sources to enhance cybersecurity posture.