Customers can create and import threat intelligence feeds from various sources, including STIX TAXII servers, STIX JSON files, other file types (CSV, JSON, TXT, STIX), URLs, or empty feeds for custom repositories. These feeds enable automation, organization, and integration with security tools to provide actionable intelligence and proactive threat management.
Overview of Feed creation options
Creating a feed allows you to organize, analyze, and share threat intelligence data in a standardized format. Each feed creation method serves specific use cases:
STIX TAXII Server Feed: Automates and prioritizes threats using a standardized, shareable format for integration with threat intelligence platforms.
STIX JSON File Feed: Organizes and connects threat data with other tools, enabling analysis of threat evolution and relationships.
File-Based Feed (CSV, JSON, TXT, STIX): Ideal for simple analysis, quick reference, or integration with tools supporting direct file imports. Supports historical analysis, predefined datasets, and offline data use.
URL-Based Feed: Provides real-time, dynamic threat intelligence for integration with platforms like SIEM or other security tools.
Empty Feed: Acts as a personal live repository for manually adding threat intelligence indicators as needed.
Process for creating a Feed
Navigate to the platform homepage, select Threat Intelligence Management, and then select All Feeds.
From there, choose Create New Feed and select the appropriate feed creation method from the dropdown menu.
Create a Feed linked to a STIX TAXII server
This method automates threat prioritization and provides actionable intelligence in a standardized, shareable format.
Select From TAXII 2.1 from the Create New Feed dropdown.
Complete the Create a TAXII 2.1 Feed form:
Feed Name: Enter a name for your feed.
Feed Type: Select the type of feed from the dropdown.
Vendor: Enter the vendor name.
Description (Optional): Add a description of the feed.
Server URL: Enter the TAXII server URL.
Authorization: Select the authorization type from the dropdown.
API Roots: Select Load API Roots, then choose the TAXII server from the dropdown.
Collection: Select a feed to link to from the dropdown.
Select Create.
Use Case: Ideal for organizations needing automated, standardized threat intelligence to discover patterns and act proactively.
Create a Feed with a STIX JSON file
This method organizes threat data, connects it with other tools, and supports analysis of threat evolution and relationships.
Select From File from the Create New Feed dropdown.
Complete the form:
Feed Name: Enter a name for your feed.
Feed Type: Select the type of feed from the dropdown.
Vendor: Enter the vendor name.
Tag (Optional): Select + Add Tag, enter a tag name, and choose it from the dropdown to identify observables across feeds.
File: Choose Select a File, then choose a STIX JSON file from the file explorer.
Select Create.
Use Case: Ideal for users looking to organize and share structured threat data, as well as analyze threat relationships.
Create a Feed from a file (CSV, JSON, TXT, STIX)
This method is suited for simple analysis, quick reference, or integration with tools supporting direct file imports.
Supported File Types:
CSV: For sharing and storing data.
JSON: Text-based format for storing and exchanging data.
TXT: Plain text for unformatted data.
STIX: Structured format for sharing CTI.
Important: Ensure the file’s columns correspond to the represented data.
Benefits:
Historical Analysis: Store historical threat data to investigate trends, attack behaviors, and evolving threats.
Predefined Datasets: Use datasets like malware samples or IP address lists for regulatory analysis.
Offline Data: Access data in scenarios with limited or no internet connectivity.
Select From File from the Create New Feed dropdown.
Complete the form:
Feed Name: Enter a name for your feed.
Feed Type: Select the type of feed from the dropdown.
Vendor (Optional): Enter the vendor name.
Source Score (0-100) (Optional): Enter a score for the feed’s reliability.
Description (Optional): Add a description of the feed.
Tag (Optional): Select + Add Tag, enter a tag name, and choose it from the dropdown.
File: Choose Select a File, then upload a CSV, JSON, TXT, or STIX file.
Select Create.
Use Case: Useful for users with simple analysis needs, predefined datasets, or offline data requirements.
Create a Feed from a URL
This method provides real-time, dynamic threat intelligence for integration with platforms like SIEM or other security tools.
Select From URL from the Create New Feed dropdown.
Complete the form:
Feed Name: Enter a name for your feed.
Feed Type: Select the type of feed from the dropdown.
Vendor: Enter the vendor name.
Tag (Optional): Select + Add Tag, enter a tag name, and choose it from the dropdown.
URL: Enter the URL for the feed.
Source Format: Select the URL’s format from the dropdown.
Authorization: Select the authorization type from the dropdown and enter credentials.
Select Test Access to verify the URL.
Select Create.
Use Case: Ideal for real-time threat intelligence
Create an empty Feed
This method creates a personal live repository for manually adding threat intelligence indicators as you discover them.
Select From File from the Create New Feed dropdown.
Complete the form:
Feed Name: Enter a name for your feed.
Feed Type: Select the type of feed from the dropdown.
Vendor (Optional): Enter the vendor name.
Source Score (0-100) (Optional): Enter a score for the feed’s reliability.
Description (Optional): Add a description of the feed.
Tag (Optional): Select + Add Tag, enter a tag name, and choose it from the dropdown.
Select Create without uploading a file.
Use Case: Ideal for users seeking a flexible and customizable repository for threat indicators.
Create a feed from a TAXII 2.1 server
Create a feed from a TAXII 2.1 server if you have complex security needs that require real-time updates, structured data exchange, and automated workflows. TAXII servers handle large data volumes, automate alerts and reports, and ensure data security and compliance.
From the homepage, select Threat Intelligence Management, and then select Feeds.
Select Create New Feed, then choose From TAXII 2.1.
In the Feed name box, enter the name of your feed.
In the Feed type box, select your feed type.
(Optional) In the Vendor box, enter the vendor name.
(Optional) In the Description box, enter a description of the feed.
In the Server URL box, enter the TAXII server URL.
In the Authorization box, select the authorization type and enter credentials.
Select Load API Roots, then in the API Root box, select the API root.
In the Collection box, select the collection to include the feed in, and then select Create.