Outgoing feed - TAXII 2.1 push#
This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Create and configure outgoing feeds.
TAXII 2.1 push
For more information on STIX 2.1 support, see STIX compatibility.
This outgoing feed publishes STIX 2.1 packages to a target remote TAXII 2.1 server.
To host a TAXII 2.1 server on the Intelligence Center that users can retrieve data from instead, see Outgoing feed - TAXII 2.1 poll.
A remote TAXII 2.1 server to publish data to.
Network access between the Intelligence Center and the TAXII 2.1 server.
A collection to write to on the TAXII 2.1 server.
A user with write access to that collection.
Username and password for that user.
Configure the outgoing feed#
Create or edit an outgoing feed.
Under Transport and content, fill out these fields:
Required fields are marked with an asterisk (*).
Select TAXII 2.1 push from the drop-down menu.
Select STIX 2.1 from the drop-down menu.
Select one or more existing datasets from the drop-down menu.
Select an update strategy.
Supported update strategies:
(Optional) To list all collections available for your credentials:
Enter your Username and Password for the remote TAXII 2.1 server in the fields below.
Enter the discovery endpoint for your remote TAXII 2.1 server.
API Root URL*
Enter the API root URL for the collection you want this outgoing feed to push data to.
Enter the identifier for the collection that you want this outgoing feed to push data to.
This can be a UUID or an alias. For example:
For more information, see the TAXII 2.1 specifications.
Enter your user name for the remote TAXII 2.1 server.
Enter your password for the remote TAXII 2.1 server.
Selected by default.
Extra HTTP headers
Select + ADD to add custom HTTP headers to send when making requests to the target collection.
Two fields will appear:
Enter the header name in the left field. E.g.:
Enter the header value in the right field. E.g.:
Processing > Observable and Enrichment Observable types > Observable types
If your selected dataset(s) include indicator entities that do not have a STIX 2.1-compatible test mechanism defined, you must include observable types here.
See Known issues below for more information.
Store your changes by selecting Save.