Add a New Source
You can add an RSS source to receive the latest threat intel. You can also add an RSS source from Administration > Integration Management > RSS.
To add a new source, do the following:
From the Main Menu, open RSS Feeds under Collection.
Click Add New Source.
Enter a unique name to identify the RSS feed source.
Enter the feed URL for the appropriate source website.
You can obtain the website URL if the feed subscription feature is available for the website.
To assign default metadata (such as TLP, confidence score, and more) to report objects, select Assign Default Metadata to Report and provide the following information:
TLP: Select a default TLP to be assigned to the report from the RSS feed.
Confidence Score: Set a default confidence score to be assigned to the report from the RSS feed.
Deprecates after: Set the duration in days after which the threat data (indicator) will be deprecated, unless the source provides an expiry duration (Range: 1–180 days). If the same indicator is received from multiple sources, the longest valid duration is applied.
Custom Scores: Set the default values for custom scores to be assigned to the report from the RSS feed.
Tags: To identify and categorize the account, add tags.
To assign the metadata to all objects associated with the report object, select Apply Default Metadata to all objects. If not selected, metadata is assigned only to the report object.
To automatically create intel for the received feeds, select Create intel automatically.
To parse IOCs from the feed description, select Parse IOCs only from visible content.
Note
HTML tags are not considered for parsing.
To validate a source URL for a trusted CA certificate or a self-signed SSL certificate, select Verify SSL.
By default, this check box is selected.
Click Add.