Current ThreatQ Version Filter
 

Data Feed Subscriptions

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative or Maintenance
Custom Role - Action Permissions: Data Exchange - Edit Data Exchange Feeds

Once a data feed has been shared with you, it will appear in under your Incoming Feeds with a status of Offered.  This indicates that the feed has been shared with your instance.  

Subscribing/Unsubscribing to a Feed from the OpenDXL Connections Node View

The following provides you with steps on how to subscribe and unsubscribe to/from a data feed from the OpenDXL Connections Node view.  

  1. Navigate to your OpenDXL Connections Node view.
  2. Click on your instance node to load its details in the right pane.
  3. Locate the shared feed under the Incoming Feeds heading.

    Shared but not subscribed data feeds will be listed with a status of Offered.

  4. Click on the enable/disable toggle switch to either subscribe or unsubscribe to the data feed.
  5. If you are subscribing to a feed, you will be prompted to select the default statuses to apply to threat objects ingested from the feed.  Set your default statuses and Subscribe.     

Subscribing/Unsubscribing to a Feed from the Feed Ingestion Settings Page

The following provides you with steps on how to subscribe and unsubscribe to/from a data feed from the Feed Ingestion Settings page.  

  1. Navigate to the OpenDXL Data Feeds page.
  2. Click on the shared data feed under the Incoming Feeds header.

    Shared but not subscribed data feeds will be listed with a status of Offered.

  3. Click on the subscription toggle option to subscribe or unsubscribe to the data feed.  

  4. If you are subscribing to a feed, you will be prompted to select the default statuses to apply to threat objects ingested from the feed.  Set your default statuses and Subscribe