Incoming feed - Urlscan#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.


Specifications

Transport type

UrlScan Pro Incoming Feed

Content type

Url Scan Pro JSON

Ingested data

Retrieves Indicators with Observables

Processed data

Indicator with related Observables.

Description

Retrieve and process information on indicators

Configure the Incoming feed#

  1. Create an Incoming feed.

  2. From the Transport type drop-down menu, select UrlScan Pro Search Incoming Feed.

  3. From the Content type drop-down menu, select Url Scan Pro JSON.

  4. The API URL field is automatically filled in with the default domain for the endpoint: https://urlscan.io/api/v1/search/.
    You can add a proxy or set up ports according to your needs.

  5. In the API key field, enter your Urlscan API key.

  6. In the Enter Query String to Search on UrlScan Pro, provide your search query. For query format refer: documentation.

  7. Select the Start ingesting from field, use the drop-down calendar to select a start date, and set a start time. The feed will fetch content from the stream starting from the time you specified.

  8. To store your changes, select Save.