Set up Threat Intelligence Director
This task establishes a fully functional Threat Intelligence Director deployment by ensuring proper installation requirements, policy configuration, and intelligence source integration.
Setting up Threat Intelligence Director involves configuring multiple components in a specific sequence to ensure optimal threat intelligence capabilities.
Note | If you encounter an issue during Threat Intelligence Director configuration or operation, refer to Troubleshoot Threat Intelligence Director. |
Procedure
Step 1 | Ensure that your installation meets the requirements for running Threat Intelligence Director. |
Step 2 | For each managed device, configure the policies required to support Threat Intelligence Director and deploy those policies to the devices. See Configure policies to support Threat Intelligence Director. You can configure elements before or after you ingest intelligence data sources. |
Step 3 | Configure the intelligence sources that you want Threat Intelligence Director to ingest. See Source requirements and the topics under Options for ingesting data sources. |
Step 4 | Publish data to the elements if you have not yet done so. |
What to do next
-
Include Threat Intelligence Director in your regularly scheduled backups. See About backing up and restoring Threat Intelligence Director data.
If your Cloud-Delivered Firewall Management Center deployment is a high availability configuration, see also Cloud-Delivered Firewall Management Center high availability disaster recovery.
-
(Optional) Grant administrative access to Threat Intelligence Director functionality as desired. See User roles with Threat Intelligence Director access and Users for the Cloud-Delivered Firewall Management Center .
-
As needed during operation, fine-tune your configuration. For example, add observables that produce false positive incidents to the Do Not Block list. See View and change Threat Intelligence Director configurations.