Working with Feeds

Feeds in ThreatQ provide automated ingestion of threat intelligence from external sources. The ThreatQ SDK allows you to retrieve feed configurations, inspect feed settings, and manage feed status programmatically. This section demonstrates how to work with Incoming Feeds using the ThreatQ SDK.

Import the Feed Object

Before interacting with feeds, import the Feed class:

Copy Code

Retrieve a Feed by Name

To retrieve the configuration of a specific feed by name, create a Feed object and use the by_name() method.

Copy Code

The SDK populates the Feed object with the feed's configuration and metadata.

Available Feed Properties

After retrieval, the following properties are available on the Feed object:

Property	Description
id	Unique identifier assigned to the feed.
name	Display name of the feed in ThreatQ.
namespace	Namespace associated with the feed, used to organize imported intelligence.
category	Human-readable category assigned to the feed.
category_id	Unique identifier of the feed category.
connector_definition_id	Identifier of the connector definition used by the feed.
frequency	Configured interval at which the feed is executed and imports data.
is_active	Indicates whether the feed is currently enabled (True) or disabled (False).
indicator_status_id	Default status assigned to indicators imported by the feed.
tlp_id	Traffic Light Protocol (TLP) level associated with feed content.
custom_fields	Collection of feed-specific custom configuration values.
created_at	Date and time when the feed was created.
updated_at	Date and time when the feed configuration was last modified.
last_import_at	Date and time of the most recent successful feed import.
last_import_count	Number of objects imported during the most recent feed execution.
gate_oauth2_client_id	OAuth2 client identifier associated with the feed, when applicable.

These properties provide access to feed configuration details, operational status, and import history.

Retrieve a Feed by ID

To retrieve a feed using its unique identifier, use the by_id() method.

Copy Code

This method populates the Feed object with the same metadata and configuration information available when retrieving a feed by name.

Enable a Feed

To enable a feed and allow it to resume scheduled imports, use the enable() method.

Copy Code

Once enabled, the feed will operate according to its configured schedule and settings.

Disable a Feed

To temporarily suspend a feed and prevent future imports, use the disable() method.

Copy Code

Disabling a feed preserves its configuration while preventing additional data ingestion until the feed is re-enabled.