Home
Threat Intelligence
Configuration
Details on how to configure Threat Intelligence.
Threat Intelligence Feed
Configuration
Configure ThreatQ
Follow these steps to add and enable a new TAXII feed integration in ThreatQ, verify indicator ingestion, and monitor the integration's status through the Activity Log.

Threat Intelligence
- Introduction
  An overview of Threat Intelligence.
- Requirements
  A description of the requirements that are necessary to install and use Threat Intelligence.
- Configuration
  Details on how to configure Threat Intelligence.
  - Configure a Threat Intelligence license
    Before you can use the Threat Intelligence, you must install a license.
  - Enable automatic updates
    If you are connected to Vantage, or a Central Management Console (CMC), you can enable automatic Threat Intelligence updates.
  - Configure manual updates
    If your sensor, or Central Management Console (CMC), is not connected to the internet, you can update Threat Intelligence manually.
  - Sensor-level contents management
    By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.
  - Manage contents at sensor level
    You can change the status of the Enable local contents toggle to change how the Threat Intelligence contents are managed.
  - Threat Intelligence Feed
    - Introduction
    - Requirements
    - Configuration
      - taxii2client configuration
        Learn how to use the minimal Python library from OASIS to set up a taxii2client to interact with the TAXII server from Nozomi Networks. This includes integration for software that does not support the TAXII 2.0 protocol.
      - Configure Anomali STAXX
        Do this procedure to configure the Anomali STAXX, a free TAXII/STIX solution, for integration with the Nozomi Networks TAXII server, including setting descriptions, uniform resource locators (URLs), and authentication details.
      - Configure Microsoft Sentinel
        Once the Threat Intelligence - TAXII data connector is installed, you need to configure the TAXII server.
      - Configure ThreatQ
        Follow these steps to add and enable a new TAXII feed integration in ThreatQ, verify indicator ingestion, and monitor the integration's status through the Activity Log.
      - Configure QRadar
        Do this procedure to integrate a new TAXII feed into QRadar to enhance threat intelligence capabilities. This procedure covers adding the feed, ensuring full indicator ingestion, and monitoring the integration via the Activity Log for optimal security posture.
    - Troubleshooting
- Maintenance
  Information on how to maintain Threat Intelligence.
- Print format documentation
  A list of all the print-format documentation that is available for Threat Intelligence.

Configure ThreatQ

Follow these steps to add and enable a new TAXII feed integration in ThreatQ, verify indicator ingestion, and monitor the integration's status through the Activity Log.

Open ThreatQ.
Go to Integrations > My Integrations.
In the top right section, select Add New Integration.

A dialog shows.
Select Add New TAXII Feed.
Enter the details in each field.

Do not use Collection identifier (ID)s, use Collection names.
Select Add TAXII Feed.
In the My Integrations page, select the integration that you just created.
In the top left section, select the toggle to Enabled.
Select Save.
Select Activity Log.
In the Activity Log Details section, make sure that the first manual, or scheduled, run shows as Completed.
Make sure that the indicators have been ingested correctly.

ThreatQ has been configured.