Overview

Threat Intelligence intel-indicator feed integrations can be configured within the Intel Management API. The configuration information that you supply will be validated against the external intel feed service. Once configured and validated, the intel feed will be automatically inserted into the ATR's intel-indicator ingest service.

Threat Intelligence feed integrations API documentation:

• Proofpoint TAP
• Threat Connect
• CrowdStrike Intel
• Recorded Future Connect

Viewing Integrations

To view Intel Feed integrations:

1. Click the gear icon in the toolbar.
2. Click Account Management.
   • If you have admin access to multiple accounts, click the account you wish to view from the list.
   • If you have admin access to only one account, skip this step.
3. Click the Modules tab to view the feeds that are enabled on the selected account.

Configuration

To enable Intel Feed integrations:

1. Click the gear icon in the toolbar.
2. Click Account Management.
   • If you have admin access to multiple accounts, click the account you wish to view from the list.
   • If you have admin access to only one account, skip this step.
3. Click the Modules tab to view the feeds on the selected account.
4. Click Enable next to the integration option you wish to enable.
5. When prompted, enter the required information to authenticate the connection. The requirements vary depending on the feed.
   • For Proofpoint TAP, enter the service principal and secret.
   • For CrowdStrike Intel, enter the client id and secret.
   • For ThreatConnect, enter the api id, secret, and optionally subdomain and owners.
   • For Recorded Future Connect, enter the connect token.
6. Click Save.