Feed Integrations

Configure feed integrations in Cortex XSOAR 6.12.

Cortex XSOAR includes several threat intelligence feed integrations, which you can install from content packs in Marketplace. For example:

• Unit 42 Feed
• Unit 42 Intelligence
• TAXII
• AlienVault
• AWS
• MITRE ATT&CK

Note

Some third-party services (such as Whois and MITRE ATT&CK) enforce strict rate limits based on the source IP address. If you encounter quota management issues, we recommend running them on an engine. This routes the traffic through your own private network, ensuring the external service sees a unique, dedicated IP address exclusive to your organization.

Common feed integration parameters

This is a non-exhaustive list of the most common feed integration parameters. Each feed integration might have parameters unique to that integration. Read the documentation for specific feed integrations.

Parameter	Description
Name	A meaningful name for the integration instance. For example, if you have separate instances to fetch indicator types, you can include the name of the indicator type that the instance fetches.
Fetches indicators	Select this option for the integration instance to fetch indicators. Some integrations can fetch indicators or incidents. Make sure you select the relevant option for what you need to fetch in the instance.
URL	The URL of the feed.
Feed Fetch Interval	How often the integration instance should fetch indicators from the feed.
Indicator Reputation	The Indicator Verdict to apply to all indicators fetched from this integration instance.
Source Reliability	The reliability of the source providing the threat intelligence data. Important To use custom field mapping with this integration instance, set the source reliability value higher than in other active enrichment integration instances. If another instance has a higher source reliability, the custom mappings for this integration instance will not populate in the dashboard.
Indicator Expiration Method	The method by which to expire indicators from this integration instance. The default expiration method is the interval configured for the indicator type to which this indicator belongs. Indicator Type: the expiration method defined for the indicator type to which this indicator belongs (interval or never). Time Interval: expires indicators from this instance after the specified time interval, in days or hours. Never Expire: indicators from this instance never expire. When removed from the feed: when the indicators are removed from the feed they are expired in the system. Note Some feeds only provide information about new indicators and do not specify when indicators are removed. Indicators from these feeds cannot be automatically expired on removal. If a feed's expiration method is set to When removed from the feed, indicators that are removed from the feed immediately expire. Note that if the feed is disabled, its expiration method reverts to that of the indicator type (time-based). Time-based expiration is set according to feed reliability. If the same indicator appears on multiple feeds, the feed with the highest reliability determines the indicator's expiration time. If multiple feeds have the same reliability, the last feed to add or modify the indicator determines its expiration time. Example: An indicator was initially fetched by Feed A, then by Feed B. Both feeds have the same reliability. Feed B's indicators are set to expire When removed from the feed. Feed B is now disabled. After Feed B is disabled, the indicator's expiration method reverts to that of the indicator type (for example, expire after 7 days). However, if Feed A then modifies the indicator (or removes and re-adds it), the expiration method changes back to Feed A's settings.
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
Trust any certificate	When selected, certificates are not checked.
Use system proxy settings	Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.
Do not use by default	Excludes this integration instance when running a generic command that uses all available integrations.

Feed-Triggered Jobs

You can define a job triggered by a delta in a feed to run a playbook when the specified feed or feeds finish a fetch operation that included a modification to the feed. The modification can be a new indicator, a modified indicator, or a removed indicator. For example, you want to update your firewall every time a URL is added to, modified, or removed from the Office 365 feed.

Note

You can customize the new job form by editing the Indicator Feed incident type.

You can run an indicator search query and taking action, by configuring Threat Intelligence Management Playbooks. For example, the TIM-Process Indicators - Manual Review playbook, tags indicators and creates an incident of those indicators that require review. For an example, see Process Indicators Using a Job Triggered By Delta.

Set the Source Reliability of Enrichment Integrations

The source reliability of enrichment integrations is set by the reliability parameter. If an enrichment integration does not have a reliability parameter, the default source reliability is A+. You can change the source reliability for a specific instance from the UI when configuring the integration instance.

Some integrations allow you to clear the source reliability at the instance level and instead use a server configuration to set the source reliability across all instances of the integration. In addition, you can use a server configuration to set the source reliability across all enrichment integration instances that do not have a source reliability set.

You can set the source reliability through the following methods:

• Through a server configuration, for all enrichment integrations.
• Through a server configuration, for a specific integration. If a source reliability is set for a specific integration, this overrides the setting for all enrichment integrations.
• In the settings for a specific integration instance. If you set the source reliability for a specific instance, this overrides the setting for the specific integration and the setting for all enrichment integrations.

Note

For either server configuration to affect an enrichment integration instance, the source reliability must be cleared first from the instance. To remove the current source reliability score, go to Settings → Integrations → Instances, find the relevant instance, and click on the gear icon to access the integration instance settings. In the Source Reliability field click the x next to the source reliability score. Note that if the Source Reliability field is a required field (a red asterisk displays next to Source Reliability) for this integration, you are not able to clear the source reliability and use server configurations to affect this instance.

To sett the source reliability for all enrichment integrations and for a specified integration do the following:

1. Remove the current source reliability score from the enrichment integration instance.

   1. Go to Settings → INTEGRATIONS → Instances.
   2. Search for the integration that you want to set the source reliability score for and click access the instance parameters.
   3. In the Source Reliability field click the x next to the source reliability score.
   4. Click Done.
2. Go to Settings → ABOUT → Troubleshooting.
3. In the Server Configuration section click Add Server Configuration.
4. To set the source reliability for all enrichment integrations:

   1. Remove any integrations.enrichment.reliability.<integration_name> advanced configurations if they exist.
   2. In the Key field, enter integrations.enrichment.reliability.
5. To set the source reliability for a specific integration, in the Key field, enter integrations.enrichment.reliability.<integration_name>, where <integration_name> is the vendor name of the enrichment integration for which to set the reliability score the reliability score (applies to all instances of the specified integration). The vendor name can be found in the indicator summary view. Type the vendor name as it appears.
6. In the Value field enter the source reliability score for the enrichment integration. You can enter only the letter or both the letter and the description in the Value field.

   • A+ - 3rd party enrichment
   • A - Completely reliable
   • B - Usually reliable
   • C - Fairly reliable
   • D - Not usually reliable
   • E - Unreliable
   • F - Reliability cannot be judged
7. Click Save.