Incoming feed - Attack Surface Management#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.


Specifications

Transport type

GTI Attack Surface Management(ASM) Feed

Content type

GTI ASM Entity

Ingested data

Retrieves Alerts for the configured project & search string.

Processed data

Report & related observables.

Description

Retrieve and process information on Reports related observables.

Note

Schedule the feed to run longer than 45 minutes so it can fetch entities in batches and resume from checkpoints until all entities are retrieved.

Configure the Incoming feed#

  1. Create an Incoming feed.

  2. From the Transport type drop-down menu, select GTI Attack Surface Management(ASM) Feed.

  3. From the Content type drop-down menu, select GTI ASM Entity.

  4. The API URL field is automatically filled in with the default domain for the endpoint: https://www.virustotal.com/api/v3/asm.

  5. In the API key field, enter your GTI API key. Sign up to the Google Threat Intelligence Platform to automatically be assigned a personal API key to access the GTI API.
    If necessary, contact the intelligence provider to subscribe to the service and to obtain this information, along with any required authentication and authorization credentials.

  6. Select the Start ingesting from field, use the drop-down calendar to select a start date, and set a start time. The feed will fetch content from the stream starting from the time you specified.

  7. In the Project ID field, enter the Project ID from which you want to fetch the alerts

  8. In the Search String field provide the search query

  9. To store your changes, select Save.