Incoming feed - RSS version 2.0#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

	Specifications
Transport type	RSS version 2.0
Content type	RSS HTML from link
Ingested data	Information made available through the RSS 2.0 web content syndication format.
Processed data	Most RSS feed URLs make available blog posts and articles that are stored to the platform as EclecticIQ HTML reports. Keywords in the source page metadata section are added as tags to the reports they refer to. Optionally, thumbnails and images are saved as attachments to the reports they refer to.
Description	Retrieve and ingest cyber threat information from feed sources that support the RSS 2.0 web content syndication format.

Configure the incoming feed#

Create or edit an incoming feed.
From the Transport type drop-down menu, select RSS version 2.0.
From the Content type drop-down menu, select RSS HTML from link.
RSS 2.0 incoming feeds retrieve content by polling URL endpoints that make information available in RSS 2.0 format.
The data provider is responsible for setting up their RSS feed channel, so that third-parties can poll it.
In the RSS URL field, enter the URL that makes the RSS feed content available for retrieval.
The feed polls this URL for updates, and to fetch content.
Example: https://www.bleepingcomputer.com/feed/.
In the Targeted element field, specify which element in the RSS feed XML structure contains the relevant content the feed should look for and fetch for further processing in the platform.
It should correspond to the element that contains the information you want to save to the platform.
Examples: article, description, div, p.
In the Targeted element attributes (comma-separated) field, you can define one or more attributes to refine the filter for the incoming feed, if the element specified in Targeted element has attributes.
Example: id=”main”, class=”main section”.
If you specify an element in Targeted element, and one or more comma-separated attributes in Attributes of targeted element (comma separated), the incoming feed looks for and fetches only RSS content that matches both criteria.
Example: Element: p. Attributes: id=”wannacry”, class=”ransomware”
The incoming feed fetches content inside  and  elements.
It does not fetch content inside  elements.
Click the Start ingesting from field, and use the drop-down calendar to select an initial date and, where available, an initial time to fetch content from the intelligence provider/data source starting from a specific date in the past.
By default, the max. amount of days in the past per each query/request is set to 30 days.
Select the Feed uses feedburner checkbox to if the source RSS feed uses Feedburner.
Select the Download thumbnails/images checkbox to to retrieve also thumbnails and images, which are saved as attachments to the resulting report they refer to.
By default, the RSS version 2.0 feed timeout value is set to 02 minutes.
To store your changes, click Save; to discard them, click Cancel.