Incoming feed - FTP download#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

Specifications

Transport type

FTP download

Content type

  • Eclectic JSON

  • Email message

  • MISP JSON

  • PDF

  • SpyCloud Breach Data JSON

  • STIX 1.0

  • STIX 1.1

  • STIX 1.1.1

  • STIX 1.2

  • STIX 2.1

  • Text

Ingested data

Structured and unstructured data in JSON, PDF, STIX, and plain text format.

Processed data

Structured, STIX-compliant entities and observables.

Requirements#

Users need a username and a password for their own configuration.

Configure the incoming feed#

  1. Create and edit an incoming feed.

  2. From the Transport type drop-down menu, select FTP download.

  3. From the Content type drop-down menu, select the content type for the data you want to ingest.
    The content type should match the data source format. This can vary, depending on the intel sources you retrieve the data from.

  4. Select the Accept password protected archives checkbox to specify a global password to open any archives retrieved through the incoming feed.
    If the archives are password-protected, enter it in the Archive password field.
    The specified password acts as a master password, and it is used to try to unlock and access any archives retrieved with the feed.
    Supported archive formats: .rar, .tar, .tar.bz2, .tar.gz, .tar.bz2, .tar.z, .zip

  5. In the URL field, enter the location on the FTP server where the data source for the feed is made available.

  6. In the Username field, enter a valid user name to authenticate and be granted the necessary authorization to access the data source and to download/ingest data.

  7. In the Password field, enter a valid password to authenticate and be granted the necessary authorization to access the data source and to download/ingest data.

  8. Select the TLS checkbox if the data source FTP server supports TLS, and if you want to enable the security layer for the feed.

  9. To store your changes, click Save; to discard them, click Cancel.

Test the feed#

  1. In the top navigation bar, click Data Configuration > Incoming feeds.

  2. Click the feed that you just created, using the steps above.

  3. In the Overview view, click Download now.

  4. Click Ingested entities and check that entities have been ingested into the platform.

Or:

  1. In the top navigation bar, click Intelligence > All intelligence > Browse.

  2. Click the Entities tab.

  3. In the top-left corner, click Filter.

  4. From the Source drop-down menu, select the incoming feed you have just created, using the steps.

  5. You can also filter also by entity type: from the Entity drop-down menu, select the entity types you want to include in the filtered results.