Configure Threat Intelligence feed integrations

Configure threat intelligence feed integrations in Cortex AgentiX.

You can download and install content packs, including threat intelligence integrations such as:

• MITRE ATT&CK
• Unit 42 Feed
• Unit 42 Intelligence
• AlienVault
• AWS

Note

Some third-party services (such as Whois and MITRE ATT&CK) enforce strict rate limits based on the source IP address. If you encounter quota management issues, we recommend running them on an engine. This routes traffic through your private network, ensuring the external service sees a unique, dedicated IP address assigned to your organization.

How to configure threat intelligence feed integrations

1. Go to Marketplace and install the relevant threat intelligence content pack.
2. Configure the threat intelligence integration by going to Settings → Configurations → Data Collection → Automation & Feed Integrations, search for your integration, and click Add Instance.

   The following table is a non-exhaustive list of the most common feed integration parameters. Each feed integration may have parameters unique to that integration. Read the documentation for specific feed integrations for more details.

   Parameter	Description
   Fetches indicators	Select this option for the integration instance to fetch indicators. Some integrations can fetch indicators or issues. Select the relevant option for what you need to fetch in the instance.
   URL	The URL of the feed.
   Feed Fetch Interval	When the integration instance should fetch indicators from the feed.
   Indicator verdict	The indicator verdict that will apply to all indicators fetched from this integration instance. See Indicator verdict.
   Source reliability	The reliability of the source that provides the threat intelligence data.
   Indicator Expiration Method	The method by which to expire indicators from this integration instance. The default expiration method is the interval configured for the indicator type to which this indicator belongs. Indicator Type: The expiration method defined for the indicator type to which this indicator belongs (interval or never). Time Interval: Expires indicators from this instance after the specified time interval, in days or hours. Never Expire: Indicators from this instance never expire. When removed from the feed: When the indicators are removed from the feed they are expired in the system. Note Some feeds only provide information about new indicators and do not specify when indicators are removed. Indicators from these feeds cannot be automatically expired on removal. If a feed's expiration method is set to When removed from the feed, indicators that are removed from the feed immediately expire. Note that if the feed is disabled, its expiration method reverts to that of the indicator type (time-based). Time-based expiration is set according to feed reliability. If the same indicator appears on multiple feeds, the feed with the highest reliability determines the indicator's expiration time. If multiple feeds have the same reliability, the last feed to add or modify the indicator determines its expiration time. Example: An indicator was initially fetched by Feed A, then by Feed B. Both feeds have the same reliability. Feed B's indicators are set to expire When removed from the feed. Feed B is now disabled. After Feed B is disabled, the indicator's expiration method reverts to that of the indicator type (for example, expire after 7 days). However, if Feed A then modifies the indicator (or removes and re-adds it), the expiration method changes back to Feed A's settings.
   Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
   Trust any certificate (not secure)	When selected, certificates are not checked.
   Use system proxy settings	Runs the integration instance using the proxy server (HTTP or HTTPS) when an engine is selected.
   Do not use in CLI by default	Excludes this integration instance when running a generic command that uses all available integrations.