FAQs

Can I install/use my own data transport?

TQX only supports the default OpenDXL transport installed with the product.

As a Subscriber, can I offer a Data Feed to another Subscriber?

Subscriber instances can offer Data Feeds to Publishers. However, they cannot offer Data Feeds to other Subscribers. For added security, Subscribers will be unable to see other Subscribers connected to the Publisher.

What happens if my Data Feed contains indicators with a custom status that a Subscriber does not have in place on their instance?

At this time, custom statuses are not supported by TQX. In this event, the custom status would not be created on the Subscriber instance nor would the system objects with that status be ingested by the Subscriber instance.

What happens if my Data feed contains indicators with a set score?

Indicator Scores are not included when sending Data Feeds to another instance.

As a Subscriber, can I unsubscribe to a data feed?

Yes. You can unsubscribe from a data feed to stop the ingestion of data. You also have the option to re-subscribe to the data feed at a later date.

As a Subscriber, can I connect to multiple Publishers?

TQX only supports one data transport per instance. This allows Publishers to connect to multiple Subscribers through one data transport. Subscribers cannot connect to multiple Publishers as it would require additional data transports.

As a Publisher, can I connect to other Publishers?

No, data Connection Bundle are designed to provide Publisher > Subscriber and Subscriber > Publisher communication.

As a Publisher that is publishing multiple Data Feeds to a Subscriber, can I remove an individual data feed?

Publishers can remove recipient instances from Data Feeds. See the Data Feed Sharing Options topic for more information.

How do I upgrade to a Publisher instance?

Contact ThreatQ Sales to purchase a Publisher license. Then, see the Licensing topic in the Help Center for information on adding this new license.