Configure incoming feeds general options

Configure the general options for incoming feeds to ingest data into EclecticIQ Platform.
These configuration options are common to all supported incoming feeds.

1. Create an incoming feed

   
   

   1. In the in the top navigation bar, go to Data configuration > Incoming feeds.
      The Incoming feeds view lists all incoming feeds configured to ingest data from the specified intelligence providers and data sources.

   2. In the top-left corner of the view, click the plus icon at the top-left corner of the page.

   3. In Create incoming feed, fill out the following fields:
      

      
      

      Required fields are marked with an asterisk ( * ).

      Field	Description
      Feed name*	Enter a descriptive label for the feed.
      Organization	Enter the name to identify the provider of this feed.
      Source reliability	Assign a level of source reliability to the feed.
      Require valid signature	Enabled by default. When selected, the platform checks the PGP signature of any packages sent by the incoming feed source against its list of Trusted keys. If the package is not signed by a trusted key, the the platform rejects it. For more information, see Add trusted PGP keys below. Selecting this option without adding the correct PGP public key for the feed source will cause the feed to fail when it runs.
      Skip extraction of observables from unstructured text	Select this option to exclude from ingestion data that is: Written in free-form text, such as text entered in title, description, or note fields. Without any defined link names to qualify its relationship with the entities it is related to, if applicable. If you select the checkbox, the platform filters out any observable data detected inside titles, headers, descriptions, summaries, and other free-form text fields. Observable data inside unstructured text fields is usually not as relevant, and not as valuable in terms of intelligence, as observable data extracted from, for example, CybOX fields or from extracts_nested JSON fields. In the same way, observables with relationships, but without any link names providing extra context and relevance, can add more noise than actual value to platform data.

Transport and content

To configure transport type and content type, as well as any other specific options for a particular incoming feed, refer to the dedicated documentation page on that feed:

Save the configuration

After setting up the feed, save the configuration:

1. Click Save to store your changes, or Cancel to discard them.

2. Or, click on the Save button to view additional save options:

   • Save and run: Saves the current configuration for the feed and runs it immediately.

   • Save and new: Saves the current configuration for the feed, and it opens a new empty form to start configuring a new feed.

   • Save and duplicate: Saves the current configuration for the feed, and it opens a prepopulated copy of the same feed configuration, which you can use as a blueprint/as a template to speed up manual work.

Add trusted PGP public key

The EclecticIQ Platform stores a list of trusted PGP public keys in Settings ( ) > System settings > Trusted Keys. Keys from this list are used to validate signed packages from incoming feeds that have the Require valid signature option enabled.

To add a PGP public key to the list of Trusted keys:

1. In the side navigation bar, select Settings ( ) > System settings > Trusted Keys.

2. Select Edit Settings.

3. In Edit public trusted keys settings:

   • Select + ADD to add a new PGP public key to the list.

   • Select + MORE to add more than one PGP public key to the list.

4. Fill out the following fields for each PGP public key you want to add:

   * Required fields.

   Field
   Description	A descriptive label for this PGP public key.
   Key	Enter the exported ASCII output for the PGP public key here. This is usually the contents of an .asc file provided by the data source. An example of an exported PGP public key: -----BEGIN PGP PUBLIC KEY BLOCK-----   mQENBF6B+4gBCACtCbXTGQwoNF2v84z9A4fDn5nhUtpBiiLwt7R0VrWRnnnn6/mw ... 5sigWh8vff3ht3GhoeeqVN8Z8ZxkQrl2GvDvUaufIAXFVAuwUZXerLe1dlXpaVUQ u6pW2rAVjXXf3eJdIKIzxkD6x4ph2A== =8f7w -----END PGP PUBLIC KEY BLOCK-----

5. Select Save to finish adding your PGP public keys.