Fetch TAXII feeds to use as sources

This task establishes TAXII feeds as threat intelligence sources to automatically retrieve STIX data for threat detection and analysis.

TAXII feeds provide structured threat intelligence data that can enhance your security posture by automatically updating threat indicators. If you encounter an issue during TID configuration or operation, see Troubleshoot Threat Intelligence Director.

Before you begin

Before configuring TAXII feeds, ensure your source meets the requirements in Source requirements.

Follow these steps to fetch TAXII feeds to use as sources:

Procedure

Step 1

Choose Integrations > + Show more > Threat intelligence director > Sources.

Step 2

Click Add (add icon).

Step 3

Choose TAXII as the Delivery method for the source.

Step 4

Enter information.

  • If the host server requires an encrypted connection, configure the SSL Settings as described in Configure TLS/SSL settings for a Threat Intelligence Director source.

  • You cannot change the Action selection for TAXII sources.

    Block is not an Action option for TAXII sources, as STIX data can contain complex indicators, which the system cannot block. Devices (elements) store and take action based on single observables; they cannot take action based on multiple observables.

    However, after ingestion, you can block individual observables and simple indicators obtained from the source. For more information, see Edit Threat Intelligence Director actions at the source, indicator, or observable Level.

  • It may take some time for the list of feeds to load.

  • The Update Every interval specifies the frequency that Threat Intelligence Director retrieves updates from the TAXII source.

    Set an update frequency that makes sense for how often the data source is updated. For example, if the source is updated 3 times per day, set your update interval to 1440/3 or 480 minutes to regularly capture the latest data.

  • After the number of days you specify for TTL, Threat Intelligence Director deletes:

    • all indicators for the source that are not included in subsequent source updates.

    • all observables not referenced by a surviving indicator.

    Note

    If the source contains no updates for the number of days specified for TTL and the source checksum remains unchanged, downloads are treated as feeds with no updates. For observables to receive a new TTL value, the source must contain a few updates.

Step 5

If you want to immediately begin publishing to elements, confirm that the PUBLISH Slider (slider icon) is enabled.

When this option is enabled, the system automatically publishes the initial source data and any subsequent changes.

For details, see Pause or publish Threat Intelligence Director data at the source, indicator, or observable Level.

Step 6

Click Save.

What to do next

  • TAXII feeds can contain a lot of data. It may take some time for the system to ingest all of the data. To view ingestion status, refresh the Sources page.

  • If you see an error for this source, hover over status for details.

  • If you are doing initial Threat Intelligence Director configuration, return to Set up Threat Intelligence Director.