Connect to the FS-ISAC IntelX Exchange in Cortex XSOAR

Learn how to connect to the FS-ISAC IntexX Exchange in Cortex XSOAR 8 SaaS or Cortex XSOAR 8x On-prem.

This quick start guide is intended to assist FS-ISAC member firms in connecting and configuring Cortex XSOAR through a STIX/TAXII feed integration with the FS-ISAC Threat Intelligence Exchange Repository (IntelX Repo).

Cortex XSOAR, a Security Orchestration, Automation, and Response Platform, offers valuable integration capabilities with the FS-ISAC STIX/TAXII Server. This integration allows FS-ISAC Member Firms to connect and configure Cortex XSOAR to receive threat intelligence feeds from the FS-ISAC Threat Intelligence Exchange Repository (IntelX Repo) through the STIX/TAXII feed.

Configuration

Multiple STIX/TAXII collections can be configured using the TAXII feed integration using multiple instances. Cortex XSOAR supports all TAXII server versions, but we recommend using TAXII2.1.

Configuration Steps

1

Install the TAXII Feed integration

1. Go to Marketplace.

2. To find the TAXII Feed content pack, search for ingest Taxii.

1. Select the TAXII Feed content pack and install it. For more information, see TAXIII Feed Content Pack.

2

Set up the FS-ISAC instance in Cortex XSOAR

1. Go to Settings & Info → Settings → Integrations → Instances.

2. Search for TAXII, and on the relevant integration (TAXII 2 Feed for a 2.x server), click Add Instance.

3

Define the integration instance parameters

The following setup is relevant for the TAXII 2 Feed integration.

1. In the Connect section, add the following parameters:

   Parameter	Description
   Name	Adjust the instance feed name. We recommend the name FS-ISAC-<collection name>.
   Discovery Service URL	Set to https:/taxii.fsisac.com/ctixapi/ctix21/taxii2/.
   Username/API Key	As provided by FS-ISAC.
   Password	As provided by FS-ISAC.
   API Root to Use	Leave empty.
   Collection Name to Fetch Indicators From	Use the collection name to fetch a specific collection. If not given, the integration will try to fetch all collections from the server. The collection name is required, not the ID.

2. In the Collection section, add the following parameters:

   Parameter	Description
   Source Reliability	We recommend setting the reliability to B. We use A for raw data, such as allowed IPs of a service, for example IPs published by AWS.
   Traffic Light Protocol Color	Set according to FS-ISAC guidelines, Amber and above.
   Max Indicators Per Fetch (disabled for Full Feed Fetch)	Leave empty.
   First Fetch Time	This determines how far back Cortex XSOAR pulls in the first fetch. The default is 1 year, but you can adjust it if needed.
   STIX Object to Fetch	Leave as is, unless you want the feed to fetch a specific type of SCO. This refers to the STIX object type, not the actual indicator. For example, an Indicator STIX object with an IP pattern will not be fetched if only IP is selected.
   Max STIX Objects Per Poll	The default is 100. Do not change it unless needed.
   Indicator Expiration Method	We recommend By Indicator type.
   Feed Fetch Interval	Set according to FS-ISAC guidelines. The Cortex XSOAR default is 4 hours.
   Incremental Feed	Select the checkbox.
   Full Feed Fetch	Deselect the checkbox.
   Tags	We recommend adding FS-ISAC-<Collection name> to the tags for easier querying.

3. Click Test. A new window should appear and show Success.

4. Close the test window and click Save & Exit. Your new FS-ISAC instance is up and running.