Creating a Data Feed

Publisher and Subscriber instances can create data feeds to share.  Publishers can share data feeds with all subscribers while subscribers can only share their data feeds with the publisher.  

1. Click on the Data Exchange menu item and select Data Feeds.
   
   The OpenDXL Data Feeds page will load.  Here you can view any existing incoming and outgoing feeds.
   
   
2. Click on the Create Feed button.
   
   The Create Feed form will load.
   
   
3. Enter a Feed Name.  This is the name that will appear in the UI.  
4. Select a Publish Frequency that which the feed will be sent out to other ThreatQ instances.
   Options include:
   • Daily
   • Hourly
5. Enter a Description for the data feed.
6. Select the Recipients to receive the data feed.  You can select specific instances or enable the Offer Feed to Public option. 

   Subscribers can only send data feeds to the publisher. Only the publisher will offered when selecting a recipient.  The Offer Feed to Public option will not be offered.  See the Data Feed Subscriptions topic for more details on subscribing and unsubscribing to a data feed.  

7. Select a data collection for the Dataset field.  

   You can also click on the Create a New Data Collection option to be taken to the Threat Library to create a data collection.

8. Select which Supporting Context will be included in the data feed using the checkboxes provided.  
9. Select which Relational Data (related objects) to include in the data feed.
10. Use the Override Source checkbox under the Data Modifications heading and enter a name to override the default source name for the feed. 

    A Subscriber can view the Data Feed source name under object sources in their object details page.

11. Click on the Disabled/Enabled toggle to enable the data feed.
12. Click on Save to create the data feed. 
    
    The OpenDXL Data Feeds page will load with the new feed listed.  The recipients of the feed receive a system notification that a new feed is available for subscription. This notification includes a link to the OpenDXL Data Feeds page which allows the recipient to review feed details before subscribing.