This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Configure outgoing feeds general options.
TAXII 2.1 push
For more information on STIX 2.1 support, see STIX 2.1 documentation.
This outgoing feed publishes STIX 2.1 packages to a target remote TAXII 2.1 server.
To host a TAXII 2.1 server on the Intelligence Center that users can retrieve data from instead, see Outgoing feed - TAXII 2.1 poll.
A remote TAXII 2.1 server to publish data to.
Network access between the platform and the TAXII 2.1 server.
A collection to write to on the TAXII 2.1 server.
A user with write access to that collection.
Username and password for that user.
Configure the outgoing feed
Create or edit an outgoing feed.
Under Transport and content, fill out these fields:
Required fields are marked with an asterisk (*).
Select TAXII 2.1 push from the drop-down menu.
Select STIX 2.1 from the drop-down menu.
Select one or more existing datasets from the drop-down menu.
Select an update strategy.
Supported update strategies:
(Optional) To list all collections available for your credentials:
Enter your Username and Password for the remote TAXII 2.1 server in the fields below.
Enter the discovery endpoint for your remote TAXII 2.1 server.
For example: https://taxii.example.com/taxii2/
API Root URL*
Enter the API root URL for the collection you want this outgoing feed to push data to.
For example: https://taxii.example.com/example-api-root-name/
Enter the identifier for the collection that you want this outgoing feed to push data to.
This can be a UUID or an alias. For example:
For more information, see the TAXII 2.1 specifications
Enter your user name for the remote TAXII 2.1 server.
Enter your password for the remote TAXII 2.1 server.
Selected by default.
Store your changes by selecting Save.