Automatic Ingest of Threat Feeds

[OzRex08]

It would be good to be able to ingest opensource and commercial threat feeds automatically by choosing a feed url.

Current Workaround

Indicators need to be imported manually.

Proposed Solution

• Have the ability to select from a range of opensource feeds and have them automatically ingest either on demand, or once per day etc.
• Be able to categorise feeds being ingested into appropriate categories (i.e. Phishing IP's; C2 Domains; Hashes of Malware etc)

Additional Information

[NetEyes]

Finally they release a VM ready. Much appreciated.
I will be evaluating this version and hopefully they soon to add this feature - automatic feed ingestion. We have a commercial threat feed provider (can only access thru taxii/stix2 format) and we would like the OpenCTI to ingest (polling) automatically once it configured.

[SamuelHassine]

Hello,

For the moment, we've decided to maintain the current implementation of connector with external configurations. Another tool may be created for this purpose.