About Data Feeds

Data Feeds are used to transmit threat intel data from one instance to another.  You select a Data Collection to configure the information to share with other instances, determine the support context included with the intel, and select the instances to share this data with.  You also have the ability to override the source of the Data Feeds.  After you create the feed, the recipients receive a system notification.  They can then subscribe to the feed to begin receiving data from it.

It is recommended that you allow your subscribers to connect to your instance before assigning a Data Feed.  This allows your instance to push out the Data Feed immediately.  If you assign a Data Feed to an instance that has yet to connect, the Data Feed will be pushed at the next frequency if there are new objects in the Data Feed.  

You can manage feeds from the OpenDXL Data Feeds page and the Topology View.  The OpenDXL Data Feeds page allows you to create/edit feeds and provides you with a comprehensive list of the Data Feeds you send (Outgoing Feeds) and the ones you receive (Incoming Feeds).  Based on the Feed type, Outgoing or Incoming, you can perform different actions.