Home
Threat Intelligence
Learn how Threat Intelligence quickly detects threats to OT/IoT systems and defends against cyberattacks.
Configuration
Details on how to configure Threat Intelligence.
Threat Intelligence Feed
Requirements
Server information
Server information for Trusted Automated Exchange of Indicator Information (TAXII) services, highlighting uniform resource locators (URLs) for discovery and root access, server protocol and Structured Threat Information Expression (STIX) versions, along with collection IDs for threat types such as phishing and ransomware.

Threat Intelligence
Learn how Threat Intelligence quickly detects threats to OT/IoT systems and defends against cyberattacks.
- Introduction
  An overview of Threat Intelligence.
- Requirements
  A description of the requirements that are necessary to install and use Threat Intelligence.
- Configuration
  Details on how to configure Threat Intelligence.
  - Configure a Threat Intelligence license
    Before you can use the Threat Intelligence, you must install a license.
  - Enable automatic updates
    If you are connected to Vantage, or a Central Management Console (CMC), you can enable automatic Threat Intelligence updates.
  - Configure manual updates
    If your sensor, or Central Management Console (CMC), is not connected to the internet, you can update Threat Intelligence manually.
  - Sensor-level contents management
    By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.
  - Manage contents at sensor level
    You can change the status of the Enable local contents toggle to change how the Threat Intelligence contents are managed.
  - Threat Intelligence Feed
    - Introduction
    - Requirements
      - Server information
        Server information for Trusted Automated Exchange of Indicator Information (TAXII) services, highlighting uniform resource locators (URLs) for discovery and root access, server protocol and Structured Threat Information Expression (STIX) versions, along with collection IDs for threat types such as phishing and ransomware.
    - Configuration
    - Troubleshooting
- Maintenance
  Information on how to maintain Threat Intelligence.
- Print format documentation
  A list of all the print-format documentation that is available for Threat Intelligence.

Server information

Server information for Trusted Automated Exchange of Indicator Information (TAXII) services, highlighting uniform resource locators (URLs) for discovery and root access, server protocol and Structured Threat Information Expression (STIX) versions, along with collection IDs for threat types such as phishing and ransomware.

Table 1. Server information
Syntax	Description
Trusted Automated Exchange of Indicator Information (TAXII) Discovery uniform resource locator (URL)	https://ti-taxii.nws.nozominetworks.io/taxii/
TAXII Root URL	https://ti-taxii.nws.nozominetworks.io/root/
Server protocol	TAXII 2.0
Structured Threat Information Expression (STIX) version	STIX 2.0

Table 2. Collection IDs
Operational Technology (OT)	`thw2k6rf-w130-zaiv-i606-rsm42fk4dwms`
Internet of Things (IoT)	`aq6odbpq-5tzs-zonm-yr2p-3djab10n5t6k`
Phishing	`24ml9vt0-vbi4-61td-a8l3-xhuxpwxeccha`
Ransomware	`sx76qzvj-bx02-vnrn-zsd7-k9fx4g8c2tqg`
Hacking Frameworks	`56a15872-9565-4f3a-9975-340416369a4d`
General (includes indicators from all other collections)	`y6bpc38c-bxvz-49ga-y96f-558drdq2x6s4`