Configure Threat Intel feed integrations - Threat Intel Management Guide - Cortex XSIAM - Cortex - Security Operations

Threat intel management
Product
Cortex XSIAM
Creation date
2023-07-30
Last date published
2024-04-15
Category
Threat Intel Management Guide

You can download and install Threat Intel content packs including the following Threat Intel integrations such as:

  • MITRE ATT&CK

  • Unit 42 ATOMs

  • Unit 42 Intel Objects Feed

  • AlienVault

  • AWS

How to configure threat intel feed integrations

  1. Go to Marketplace and install the relevant Threat Intel content pack.

  2. Configure the Threat Intel integration by going to Settings → Settings & Info → Integrations → Instances, search for your integration, and click Add Instance.

    The following table is a non-exhaustive list of the most common feed integration parameters. Each feed integration may have parameters unique to that integration. Read the documentation for specific feed integrations for more details.

    Parameter

    Description

    Fetches indicators

    Select this option for the integration instance to fetch indicators.

    Some integrations can fetch indicators or incidents. Select the relevant option for what you need to fetch in the instance.

    URL

    The URL of the feed.

    Feed Fetch Interval

    When the integration instance should fetch indicators from the feed.

    Indicator verdict

    The indicator verdict that will apply to all indicators fetched from this integration instance. See Indicator verdict.

    Source reliability

    The reliability of the source that provides the threat intelligence data.

    Indicator Expiration Method

    The method by which to expire indicators from this integration instance. The default expiration method is the interval configured for the indicator type to which this indicator belongs.

    • Indicator Type: The expiration method defined for the indicator type to which this indicator belongs (interval or never).

    • Time Interval: Expires indicators from this instance after the specified time interval, in days or hours.

    • Never Expire: Indicators from this instance never expire.

    • When removed from the feed: When the indicators are removed from the feed they are expired in the system.

    Bypass exclusion list

    When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.

    Trust any certificate (not secure)

    When selected, certificates are not checked.

    Use system proxy settings

    Runs the integration instance using the proxy server (HTTP or HTTPS) when an engine is selected.

    Do not use in CLI by default

    Excludes this integration instance when running a generic command that uses all available integrations.