Skip to main content

Cyware Threat Intelligence eXchange

NCSC Netherlands

Connector Category: API Feed Source

Notice

The integration is available in Intel Exchange from v3.7.4.0 (Early Access).

Overview 

What is this integration about? 

Intel Exchange integrates with the National Cyber Security Centre (NCSC) Netherlands to provide enriched threat intelligence, enabling faster and more informed threat investigations. This integration enhances cybersecurity by offering contextual insights and relationships to support proactive threat mitigation.

NCSC Netherlands integration with Intel Exchange retrieves threat data objects related to:

  • Vulnerabilities

  • Tools

  • Reports

Use Cases 

  • Access strategic vulnerability and software application advisories from NCSC Netherlands related to recent cyber threats.

  • Operationalize advisories using rules to extract actionable intelligence and automate responses.

  • Prioritize and take action on vulnerabilities reported in advisories.

  • Distribute advisories to subscribers for streamlined threat awareness and mitigation.

Configure NCSC as an API Feed Source

Configure NCSC as an API feed source to receive threat data feeds.

Before you Start 

  • You must have the View API Feed, View Feed Source, Create Feed Source, and Update Feed Source permissions in Intel Exchange.

  • You must have the base URL, client ID, and client secret key of your NCSC account.

Steps 

To configure NCSC as an API Feed source in Intel Exchange, do the following:

  1. Go to Administration > Integration Management > Feed Source > APIs.

  2. Click Add API Source.

  3. Search and select the NCSC Netherlands app.

  4. Click Add Instance.

    1. Enter a unique name to identify the instance. For example, Prod-NCSC.

    2. Enter the base URL of the NCSC instance. The default base URL is https://api.ncsc.nl/velma/v1.

    3. Enter the client ID and client secret to authenticate communication between the Intel Exchange and NCSC servers.

    4. Select Verify SSL to verify the SSL certificate and secure the connection between the Intel Exchange and NCSC servers. By default, Verify SSL is selected.

      Note

      Cyware recommends you select Verify SSL. If you disable this option, Intel Exchange may configure an instance for an expired SSL certificate. This may not establish the connection properly and Intel Exchange will not be able to notify you in case of a broken or improper connection.

  5. Click Save. 

After the NCSC instance is configured successfully, you can view the NCSC feed channels. You can configure multiple instances by clicking Manage > Add More.

Configure NCSC Feed Channel

Configure the feed channels to retrieve threat data feeds from NCSC and store the feeds in a collection.

Steps 

To configure NCSC channel, follow these steps:

  1. Go to Administration > Integration Management > FEED SOURCES > APIs.

  2. Search and select the NCSC Netherlands app.

  3. Click the ellipsis on the top right corner and select Manage.

  4. Click Manage Feed Channels.

  5. Select a feed channel.

  6. Enable the toggle.

    1. Enter the name of the collection to group the feed data. For example, RF Feeds. Intel Exchange creates the collection and stores all the feeds from the feed channel.

    2. Select from one of the following Polling Cron Schedule types to define when to poll the data:

      • Manual: Allows you to manually poll from the source collection.

      • Auto: Allows you to automatically poll for threat intel from sources at specific time intervals. The default polling cron schedule is Auto.

        • Enter a frequency in minutes between 60 and 10080 minutes in Polling Time. The default polling time is 240 minutes.

    3. Set a default TLP and confidence score to assign to the feeds that do not have a TLP and confidence score already assigned. By default, the default TLP and confidence score are set to Amber and 100, respectively.

    4. Select any tags to identify and categorize the feeds.

  7. Click Save.

The feed channel is configured, and you can poll feeds from the channels. You can enable the other feed channels, poll feeds, and view the feeds. For more information, see API Integrations.

Test NCSC Feed Channel Connectivity

Test the connectivity of the NCSC API feed channels to ensure that the connection with the correct API endpoint is established and you have permission to poll feeds.

Before you Start 

  • Ensure that the NCSC API integration is enabled.

  • Ensure that the feed channel for which you want to test connectivity is enabled.

Steps 

To test the connectivity of a feed channel, do the following:

  1. Go to Administration > Integration Management > Feed Sources > APIs.

  2. Search and select the NCSC Netherlands app.

  3. On a feed channel, click the vertical ellipsis and select View Details.

  4. In the Working Status section, click Test Connectivity.

If the connection is established, then the working status shows Running. If the connectivity is broken, then the working status shows a Connection Error. Hover over the tooltip next to Connection Error to view the error code.

Note

When the connectivity of a feed channel breaks, Intel Exchange disables the channel and re-attempts to restore the connectivity three times every hour. After a successful re-attempt to restore the connectivity, Intel Exchange enables the feed channel automatically.

To understand the error code and troubleshoot broken connectivity, see Troubleshoot Integrations.

NCSC Feed Channels

Intel Exchange provides multiple channels to poll feeds from NCSC. The following table lists all the feed channels and the NCSC API endpoints used for each feed channel.

Feed Channel

API URL

Fetch Advisories Feeds

{base_url}advisories/paginated?