Incoming feed - TAXII 2.1 poll#
This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.
TAXII 2.1 poll
This feed polls a remote TAXII 2.1 server to retrieve STIX 2.1 data and ingests them.
Configure the feed#
Create or edit an incoming feed.
Under Transport and content, fill out these fields:
Required fields are marked with an asterisk (*).
Select TAXII 2.1 poll from the drop-down menu.
Select STIX 2.1 from the drop-down menu.
Use this field to automatically set the API Root URL and Collection ID fields here.
Enter a target TAXII 2.1 discovery endpoint URL and press
Enteror select the Search icon ().
This displays a list of collections available at the discovery endpoint.
To access a discovery endpoint that requires basic authentication, select Basic authentication before setting this field.
API Root URL*
Set this to a target API root.
This can be automatically set with the **Auto
Enter the collection ID of a target collection.
Select to use basic authentication when connecting to the target TAXII 2.1 server. Fill out the Username and Password field that displays.
Select a date and time.
Only ingest data added after this date from the target TAXII 2.1 server.
If left empty, this feed assumes an Added after date of January 1st, 1970.
Objects per run (max)
Set the maximum number of STIX 2.1 objects that this feed retrieves per request.
Download time frame
Select a windowing strategy when downloading data from the target TAXII 2.1 server.
Advancing: Only download objects added to the target collection since the last time packages were downloaded from it.
Fixed: Always download all objects added since the Added after date.
The IC deduplicates entities when it processes the downloaded objects.
Selected by default. Select this option to enable SSL for this feed.
Extra HTTP headers
Select + ADD to add custom HTTP headers to send when making requests to the target collection.
Two fields will appear:
Enter the header name in the left field. E.g.:
Enter the header value in the right field. E.g.:
Under Schedule, set an Execution schedule.
Store your changes by selecting Save.