Current ThreatQ Version Filter
 

Viewing Connection Details

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative or Maintenance
Custom Role - Action Permissions: Data Exchange - Edit Data Exchange Feeds

You can view all data exchange details for your publisher instance, data transport, and subscriber instances from the OpenDXL Connections page.  

Viewing Your Outgoing and Incoming Data

  1. From the OpenDXL Connections page, click the Publisher node.

    The right pane will display the publisher details.
  2. Click the +/- button next to a section to expand/minimize details.

    The following information is available: 
    Section Description Tasks
    Incoming Feeds Lists the following information on feeds shared with you by a Subscriber:
    • Feed name
    • Publisher name
    • Date/time the you last received data from the feed   
    Subscribe to a feed.
    Specify Indicator and Signature statuses for a feed.

    See the Data Feeds section for more information on these tasks.
    Outgoing Feeds Lists the Data Collections you have shared with Subscribers.  Editing Data Feeds - Click the gear icon next to the feed name to access the Edit Feed screen where you can edit feed recipients, edit feed settings, and delete the feed.  See the Editing a Data Feed and Data Feed Sharing Options topics for more details. 

    Create Data Feeds - Clicking on the Create Feed button will open the Create Feed page - See the Creating a Data Feed for further details. 

    Activity Log Lists a time/date stamp and brief description for TQX activities such as your initial setup as a Publisher.  Click the Show More link to expand the activity log display.

    Publisher View - Publisher

Viewing Data Transport Details

  1. From the OpenDXL Connections screen, click the Data Transport node.

    The right panel will load the data transport details.

  2. Click the +/- button next to a section to expand/minimize details.

    The following information is available:
    Section Description Tasks
    Credential Management Allows you to work with connection bundles for new or existing Subscribers connected to the Data Transport.  Download a connection bundle. - Click the Connection Bundle link next to the Subscriber name.
    Delete a Subscriber's connection.
    - Click the trashcan icon  next to the Subscriber name to delete his connection to the data transport.
    Create a connection bundle.
    - See the Create a Client Connection Bundle topic for more information on this process.
    Client Discovery Lists the Subscribers connected to the Data Transport and the Data Feeds they receive.
    View Subscriber feed details.
    - Click the arrow next to the Subscriber name to view:
    • Feeds received by the Subscriber
    • Feed frequency (hourly or daily)
    • Date/time the Subscriber last received data from the feed
    Remove a Subscriber from a feed. - See the Data Feed Sharing Options topic for more details.
    Share/Create a feed. - Click the Share Feed button to access the Share Feed window. From this window, you can:
    • Share an existing feed. - Click the checkbox next to an existing feed you want to share with the Subscriber. Then, click the Share feed button.
    • Create a new feed. - Click the Create New Feed button to access the Create Feed window and share a data collection with a subscriber.
    Activity Log Lists a time/date stamp and brief description for feed activities such as, the initial setup of the Publisher and Subscriber(s). Click the Show More link to expand the activity log display.

    Publisher View - Data Transport

Viewing Subscriber Details

  1. From the OpenDXL Connections screen, click a Subscriber node.
    The right side of the screen displays a details panel including the following sections:
    Section Description Tasks
    Incoming Feeds Lists feeds the Subscriber has shared with you.  Subscribe to a feed.
    Specify Indicator and Signature statuses for a feed.

    See the Data Feeds topic for more information on these tasks.
    Outgoing Feeds Lists the feeds you have shared with the Subscriber. Remove a Subscriber from a feed. - See the Data Feeds topic for more details.
    Edit a Data Feed. - Click the gear icon next to the feed name to access the Edit Feed screen. From this screen, you can:
    • Edit feed details. - Enter your changes and click the Save button.
    • Delete a feed. - Click the Delete Feed button. The Are You Sure? window prompts you to confirm the deletion by clicking the Delete Feed button.
    Share/create a feed. - Click the Share Feed button to access the Create Feed window. From this window you can:
    • Click the Share Feed button to share an existing feed with the Subscriber.
    • Click the Create New Feed button to access the Create Feed window and Share a Data Collection with a Subscriber.
    Activity Log Lists a time/date stamp and brief description for feed activities such as, initial setup of the Subscriber. Click the Show More link to expand the activity log display.
  2. Click the +/- button next to a section to expand/minimize details.

    Publisher View - Subscriber

Updating the Name of a Node

TQX allows you to change the names of Publisher, Subscriber, and Data Transport nodes. Each Publisher and Subscriber node has a name and a Universally Unique Identifier (UUID). Although you cannot change UUIDs, you can customize the names of the nodes in your Topology View.

Any name changes you perform on your instance will only apply to your instance. 

Example: as a publisher, changing the name of a subscriber node in your connections view will not update the subscriber's name in their view on their subscriber instance.  

  1. From the OpenDXL Connections page, click the node’s icon in the Topology View.

    The node details are displayed on the right side of the screen.
  2. Click the node’s name and enter your changes.
  3. Click the checkmark on the right side of the field to save your change.

    TQX will confirm your change with the following message: Node name updated.

Name changes can take up to thirty seconds to update for all viewers on your instance.