Current ThreatQ Version Filter
 

Data Feed Sharing Options

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative or Maintenance
Custom Role - Action Permissions: Data Exchange - Edit Data Exchange Feeds

You can edit who you share your data feeds with from the data feed's details page.  Publishers can share data feeds with all connected instances while subscribers can only share their data feeds with the publisher instance they are connected to in TQX.  Once you have shared a feed another instance, it will appear as an offered incoming feed.  The instance will then be able to subscribe to the shared feed. 

Sharing a Data Feed

  1. Navigate to the Data Feed's details page by either:
    • Connection Node View - clicking on the gear icon next to the data feed under the Outgoing Feeds heading.
    • Accessing the OpenDXL Data Feeds page and clicking on the data feed under Outgoing Feeds heading.
  2. Click on the Add button under the Recipients heading to select an instance to share the data feed with. 

    Publishers will have an additional option to Offer Feed to Public, which will share the feed with all instances connected. This option is not available to subscriber instances, who are only permitted to share data feeds with the publisher.

  3. Click on Save to save your changes.   

Unsharing a Data Feed from the OpenDXL Data Feed details Page

  1. Navigate to the OpenDXL Data Feeds page.
  2. Click on the data feed to edit under the Outgoing Feeds heading to open the Edit Feed page.
  3. Locate the instance under the Recipients heading and click on the trash icon located to the right of row.

    Recipient Heading
  4. Click on Delete Recipient, when prompted, to confirm.  

    Confirm Deletion

Unsharing a Data Feed from the OpenDXL Connections Node View

  1. Click on the instance you no longer want to share the data feed with to load its details in the right pane.

    Topology View
  2. Locate the data feed under the Outgoing Feeds heading and click on the trash icon.
  3. Click on Remove Feed, when prompted, to confirm.  

    Confirm Removal