Outgoing feed - TAXII 2.1 poll#
This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Create and configure outgoing feeds.
TAXII 2.1 poll
For more information on STIX 2.1 support, see STIX compatibility
This outgoing feed packs entities from a given list of datasets into STIX 2.1 objects and distributes them through a TAXII 2.1 collection.
These objects can then be retrieved from the IC from
with a TAXII 2.1 client.
How to get the Collection ID?
Select an existing outgoing feed
If no feed content is listed, run the outgoing feed.
Collection IDvalue, after the API Root URL.
Configure the outgoing feed#
This feed depends on the bundled Opentaxii server.
To change TAXII 2 service defaults, see Configure Opentaxii server.
Create or edit an outgoing feed.
Under Transport and content, fill out these fields:
Required fields are marked with an asterisk (*).
Select TAXII 2.1 poll from the drop-down menu.
Select STIX 2.1 from the drop-down menu.
Select one or more existing datasets from the drop-down menu.
Select an update strategy.
Supported update strategies:
Selected by default.
Processing > Observable and Enrichment Observable types > Observable types
If your selected dataset(s) include indicator entities that do not have a STIX 2.1-compatible test mechanism defined, you must include observable types here.
See Known issues below for more information.
Store your changes by selecting Save.