Home
Threat Intelligence
Configuration
Details on how to configure Threat Intelligence.
Threat Intelligence Feed
Configuration
taxii2client configuration
Learn how to use the minimal Python library from OASIS to set up a taxii2client to interact with the TAXII server from Nozomi Networks. This includes integration for software that does not support the TAXII 2.0 protocol.

Threat Intelligence
- Introduction
  An overview of Threat Intelligence.
- Requirements
  A description of the requirements that are necessary to install and use Threat Intelligence.
- Configuration
  Details on how to configure Threat Intelligence.
  - Configure a Threat Intelligence license
    Before you can use the Threat Intelligence, you must install a license.
  - Enable automatic updates
    If you are connected to Vantage, or a Central Management Console (CMC), you can enable automatic Threat Intelligence updates.
  - Configure manual updates
    If your sensor, or Central Management Console (CMC), is not connected to the internet, you can update Threat Intelligence manually.
  - Sensor-level contents management
    By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.
  - Manage contents at sensor level
    You can change the status of the Enable local contents toggle to change how the Threat Intelligence contents are managed.
  - Threat Intelligence Feed
    - Introduction
    - Requirements
    - Configuration
      - taxii2client configuration
        Learn how to use the minimal Python library from OASIS to set up a taxii2client to interact with the TAXII server from Nozomi Networks. This includes integration for software that does not support the TAXII 2.0 protocol.
      - Configure Anomali STAXX
        Do this procedure to configure the Anomali STAXX, a free TAXII/STIX solution, for integration with the Nozomi Networks TAXII server, including setting descriptions, uniform resource locators (URLs), and authentication details.
      - Configure Microsoft Sentinel
        Once the Threat Intelligence - TAXII data connector is installed, you need to configure the TAXII server.
      - Configure ThreatQ
        Follow these steps to add and enable a new TAXII feed integration in ThreatQ, verify indicator ingestion, and monitor the integration's status through the Activity Log.
      - Configure QRadar
        Do this procedure to integrate a new TAXII feed into QRadar to enhance threat intelligence capabilities. This procedure covers adding the feed, ensuring full indicator ingestion, and monitoring the integration via the Activity Log for optimal security posture.
    - Troubleshooting
- Maintenance
  Information on how to maintain Threat Intelligence.
- Print format documentation
  A list of all the print-format documentation that is available for Threat Intelligence.

taxii2client configuration

Learn how to use the minimal Python library from OASIS to set up a taxii2client to interact with the TAXII server from Nozomi Networks. This includes integration for software that does not support the TAXII 2.0 protocol.

The taxii2client is a minimal Python Trusted Automated Exchange of Indicator Information (TAXII) client from OASIS, which can be used to interact with the Nozomi Networks TAXII server. This library is useful if you want to integrate indicators that are pulled from the Nozomi Networks TAXII server with software which does not support the TAXII 2.0 protocol. For more detailed installation instructions and library documentation, see the OASIS TC Open Repository cti-taxii-client GitHub repository.

The code snippet below prints all indicator objects from the Operational Technology (OT) collection and calculates their total number:

from taxii2client.v20 import Collection, as_pages
            
COLLECTION_ID = 'thw2k6rf-w130-zaiv-i606-rsm42fk4dwms' # OT collection
TAXII_USER = 'REPLACE_WITH_PROVIDED_USERNAME_HERE'
TAXII_PASSWORD = 'REPLACE_WITH_PROVIDED_PASSWORD_HERE'
            
collection = Collection(f"https://ti-taxii.nws.nozominetworks.io/root/collections/{COLLECTION_ID}/", user=TAXII_USER, password=TAXII_PASSWORD)
total_indicators = 0
for page in as_pages(collection.get_objects, per_request=99):
    for o in page['objects']:
        if 'type' in o and o['type'] == 'indicator':
            total_indicators += 1
            print(o)
print(f"total indicators: {total_indicators}")