> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md). # Feed Integrations Cortex XSOAR includes several threat intelligence feed integrations, which you can install from content packs in Marketplace. For example: * Unit 42 Feed * Unit 42 Intelligence * TAXII * AlienVault * AWS * MITRE ATT\&CK {% hint style="info" %} ### Note Some third-party services (such as Whois and MITRE ATT\&CK) enforce strict rate limits based on the source IP address. If you encounter quota management issues, we recommend running them on an engine. This routes the traffic through your own private network, ensuring the external service sees a unique, dedicated IP address exclusive to your organization. {% endhint %} **Common feed integration parameters** This is a non-exhaustive list of the most common feed integration parameters. Each feed integration might have parameters unique to that integration. Read the documentation for specific feed integrations. | Parameter | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | A meaningful name for the integration instance. For example, if you have separate instances to fetch indicator types, you can include the name of the indicator type that the instance fetches. | | Fetches indicators |

Select this option for the integration instance to fetch indicators.

Some integrations can fetch indicators or incidents. Make sure you select the relevant option for what you need to fetch in the instance.

| | URL | The URL of the feed. | | Feed Fetch Interval | How often the integration instance should fetch indicators from the feed. | | Indicator Reputation | The [Indicator Verdict](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md) to apply to all indicators fetched from this integration instance. | | Source Reliability |

The reliability of the source providing the threat intelligence data.

Important

To use custom field mapping with this integration instance, set the source reliability value higher than in other active enrichment integration instances. If another instance has a higher source reliability, the custom mappings for this integration instance will not populate in the dashboard.

| | Indicator Expiration Method |

The method by which to expire indicators from this integration instance. The default expiration method is the interval configured for the indicator type to which this indicator belongs.

| | Bypass exclusion list | When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. | | Trust any certificate | When selected, certificates are not checked. | | Use system proxy settings | Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. | | Do not use by default | Excludes this integration instance when running a generic command that uses all available integrations. | **Feed-Triggered Jobs** You can define a [job triggered by a delta in a feed](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-feed.md) to run a playbook when the specified feed or feeds finish a fetch operation that included a modification to the feed. The modification can be a new indicator, a modified indicator, or a removed indicator. For example, you want to update your firewall every time a URL is added to, modified, or removed from the Office 365 feed. {% hint style="info" %} ### Note You can customize the new job form by editing the *Indicator Feed* incident type. {% endhint %} You can run an indicator search query and taking action, by configuring [Threat Intelligence Management Playbooks](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md). For example, the **TIM-Process Indicators - Manual Review** playbook, tags indicators and creates an incident of those indicators that require review. For an example, see [Process Indicators Using a Job Triggered By Delta](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.