Current ThreatQ Version Filter
 

Feed Run Activity

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative or Maintenance

Custom Role - Action Permissions: Integrations - Install & Uninstall Integrations

ThreatQ allows you to view feed run activity for individual CDFs from the Activity Log in a CDF's configuration page and to access information on all feed runs over the past ninety days from the Feed Run Activity tab in the Integrations page.

Feed Run Activity Details

The Feed Run Activity tab lists feed run activity for all installed feeds on the ThreatQ instance within the last ninety days. By default, this tab lists the last seven days of activity but can be updated to display the last twenty four hours, thirty days, or ninety days of activity. You can also filter the display by feed name, feed run status, or view all feeds. You can click a feed run to view more information on it or to run the feed again. 

Feed Run Activity Page

The feed run list displays run details that include:

Field Description
Feed Name The integration name.
Type of Run Whether the run was scheduled or triggered manually.
Date and Time When the run, data and time, was initiated.
Feed Run Status Whether the run completed, completed with errors, or failed.

You can click on the arrow icon next to the output to view run details such as an ingestion summary of objects ingested, download files (stored files), and additional timestamps.

Feed Run Details

Accessing Feed Run Activity

  1. Navigate to your ThreatQ instance.
  2. Click the Integrations option in the main navigation
  3. Click the Feed Run Activity tab.
    By default, this tab lists all feed runs within the last seven days.
  4. From this tab you can:
    • Select a new feed run timeframe - Click the calendar field to select the last twenty four hours, thirty days, or ninety days of activity.
    • Filter the list by feed name - Click the feed field to view all feed runs for a specific feed within the selected timeframe.
    • Filter the list by feed run status - Click the Status field to limit the list to feed runs with a status of Completed, Completed with errors, or Run failed.
    • View feed run details  - Click on the arrow icon located next to a run’s outcome status to view additional details regarding the run.
    • Refresh the feed run list - Click the refresh button in the upper right corner.