Manage your Organization Exports

  • Published on Apr 14, 2025
  • 2 minute(s) read
Prev Next

From Organization Exports, you can manage every feed that your organization creates. You can:

Search Exports

Use the Sort feeds by drop-down menu to sort your search results by ordering your organization feeds by the Newest feeds or the Oldest feeds.

To search for a specific feed in your Organization Exports:

Search for a feed in Organization Exports
  1. In the Search Feeds box, enter the name of a feed to retrieve.
  2. (Optional) Filter your search results by file types.
  3. (Optional) Filter your search results by the tags associated with a feed.

Download Exports

Download a feed for an on-demand snapshot of current threat indicators. This is ideal for ad-hoc analysis, one-time reporting, or if a security team requires a static record of threat data.

Feeds downloaded from Organization Exports are available in the following formats:

  • CSV: A text file format that uses commas to separate values, and newlines to separate records.
  • JSON: A text-based, human-readable data interchange format used to exchange data between web clients and web servers.
  • TXT: A text file format that is in non-formatted basic text.
  • RPZ: A file that contains design data and location information associated with the DNS.
  • STIX: A file of structured language that describes cyber threat information in a manner that supports sharing it, storing it, and analyzing it.

To download a feed from your Organization Exports, complete the following process:

Download a Feed from your Organization Exports
  1. From Organization Exports, locate the feed you want to download, and select Download File.
  2. Select the type of file you want to download the feed as:
    1. CSV
    2. JSON
    3. TXT
    4. RPZ
    5. STIX
  3. Select Download File, and your file downloads immediately.
  4. Select Close.

Automate Exports

Note: The API endpoint continuously updates the data, which ensures that newly added Organization feed indicators are automatically included.

Automate the export of a feed from Organization Exports to leverage an API endpoint of indicators updated every three hours. This is ideal for Enterprise customers that rely on live threat intelligence and want SIEM, SOAR, or other third-party tools to always operate with the freshest data without requiring manual intervention.

Automate the export of a feed that your organization created by accessing a live API endpoint:

Automate an Export of a Feed
  1. From Organization Feeds, locate the feed you want to download, and select Automate Export.
  2. Select the type of file you want to export.
    1. CSV
    2. JSON
    3. TXT
    4. RPZ
    5. STIX
  3. Select Copy API Endpoint.
  4. In a new address bar, paste the copied API endpoint and press Enter.

You can also access a feed that your organization created from a third-party security tool by selecting the available code snippet options:

  • cURL
  • Python
  • pHp

Copy and paste the code snippets into your favorite third-party tools for:

  • Rapid Integration: Use the code snippets to quickly test and integrate the export endpoint into your existing workflows.
  • Flexibility Across Environments: Integrate exported feeds easily into a diverse range of tools in your security stack.
  • Time Savings: Utilize pre-written and standardized snippets instead of building API integrations, which also reduces coding errors.
  • Enhanced Automation: Embed snippets into third-party tools or internal application to implement end-to-end automated processes. For example, periodic data pulls, real-time alerting, or automated updates to security dashboards.