Add Subscribers Manually in CTIX
You can add a new subscriber to the Intel Exchange application so they can share threat intel in Intel Exchange.
Before youStart
Ensure that you have View Subscribers, Create Subscribers, and Update Subscribers permissions.
Ensure that you have configured organization types.
Steps
To add a subscriber manually in Intel Exchange, follow these steps:
Go to Administration > Subscriber Management, and click Add Subscriber.
Enter the following details in Subscriber Information:
Subscriber Name: Enter a unique name to identify the subscriber within 50 characters. For example, MISP-Prod.
Organization Name: Enter the organization name within 50 characters for the subscriber.
Organization Type: Select an organization type for the subscriber to categorize and map collections to the organizations. You must configure the organization types in Intel Exchange to appear in the drop-down menu. For more information on Organization Types, see Add Organization Type.
Enter the following details in the Primary Contact Details:
Name: Enter the name of the primary contact within 50 characters. For example, John Doe.
Email: Enter the email address of the primary contact. For example, john.doe@mail.com. This email address is used to send source configuration credentials such as TAXII URL, Username, and Password to the Subscriber.
Contact Number: Enter the primary contact number. The allowed values are hyphens, spaces, plus, numbers, and parentheses. For example, +(359) 2 933 9222.
Contact Address: Enter the contact address within 300 characters.
Click + Show Secondary Contact Details to add the secondary contact details.
Enter the following details in the Subscriber Configuration:
IP Address: Enter IP addresses to establish a secure exchange of intel. You can add multiple IP addresses using a comma as the delimiter. These IP addresses will be automatically added as allowed indicators. For example, 255.255.255.255.
By default, Intel Exchange has a 0.0.0.0/0 IP address added to the IP address list to allow all IP addresses.
Collections: Select one or more collections to poll data for the subscriber. You can also modify collection preferences for a subscriber after creating a subscriber.
Confidence: Enter the confidence score ranging between 0 and 100 for the subscribers to determine the level of confidence that users have for the details shared as the threat intel shared by the subscriber.
Select Email Credentials to automatically share source authentication credentials with the subscriber over an email.
Select Include Reference Links to automatically include any reference links in the email sent out to the subscribers. For more information about reference links, see Additional Actions for Subscribers.
Click Add Subscriber.
The subscriber TAXII and MISP credentials display after you click Add Subscriber. You can view credentials, such as Name, Created Date, Last Active information, Active Status, Collections information, and more under TAXII. You can view the MISP URL and MISP auth key under MISP. You can use these credentials to integrate Intel Exchange into a subscriber's platform. Click Download to save the credentials.
After this window closes, you cannot view or retrieve these credentials again. However, you can reset these credentials. For more information about resetting the credentials, see Additional Actions for Subscribers. If you reset these credentials the existing integrations will break.
After adding a subscriber, you will receive an email with TAXII 1.x and TAXII 2.x credentials, such as username, password, discovery URL, collection URL, poll URL, collection name, and collection ID. For TAXII 1.x, the collection name acts as the collection ID, and for TAXII 2.x, the collection ID and collection name have separate values. This information helps to successfully integrate Intel Exchange feeds into your platform and starts polling data.