Incoming feed - ThreatMon#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.


Specifications

Transport type

Threatmon Incoming Feed

Content type

Threatmon JSON

Ingested data

Retrieves Alerts with Observables

Processed data

Incident with related Observables.

Description

Retrieve and process information on Alerts for the keywords sent to Threatmon

Configure the Incoming feed#

  1. Create an Incoming feed.

  2. From the Transport type drop-down menu, select Threatmon Incoming Feed.

  3. From the Content type drop-down menu, select Threatmon.

  4. The API URL field is automatically filled in with the default domain for the endpoint: https://external.threatmonit.io/api/threatmon/external/v1/darkweb/1.
    You can add a proxy or set up ports according to your needs.

  5. In the Company API key field, enter your Threatmon API key.

  6. In the Customer Name field, enter the Customer name.

  7. In the Customer License field, enter the Customer License.

  8. In the Domain Field, provide your Domain.

  9. In the Keywords Field, provide your keyword list for search.

  10. In the Contract End Date Field, provide your Contract End Date.

  11. Check the checkbox I have read and agree to the Terms and Conditions after reading the terms & conditions.

  12. Select the Start ingesting from field, use the drop-down calendar to select a start date, and set a start time. The feed will fetch content from the stream starting from the time you specified.

  13. To store your changes, select Save.