IBM Security QRadar

 View Only

  • 1.  FSISAC threat intelligence Feed with QRadar

    Posted Thu February 25, 2021 11:18 AM
    Hello Experts,

    I want to feed FS-ISAC Threat intelligence feeds into QRadar, Please has anyone successfully done this.?

    I saw a previous post on this.

    https://www.ibm.com/mysupport/s/question/0D50z00005q4Lg5CAE/threat-intelligence-fsisac-feed-error?language=en_US

    Kindly assist with steps or any links to get this done.
    Regards,

    ------------------------------
    benjamin Nworah
    ------------------------------


  • 2.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Fri February 26, 2021 10:20 AM
    I integrated the MS-ISAC feed using the Threat APP which add STIX and TAXXI ability to QRadar.  Get an API key from FS-ISAC.

    ------------------------------
    Scott Searls
    ------------------------------

    Original Message


  • 3.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Fri February 26, 2021 11:23 AM
    Hello Scott,

    Thank you for your input. Does the FS-ISAC TI feeds requires certificate ?

    Regards,


    ------------------------------
    benjamin Nworah
    ------------------------------

    Original Message


  • 4.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Thu March 04, 2021 11:58 AM
    Hello, 

    I'm sorry, I am not sure how to answer that.  

    Wish you well.

    Regards,

    Scott Searls



    Original Message


  • 5.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Wed March 10, 2021 04:10 PM
    Edited by benlinux Wed March 10, 2021 04:11 PM
    Hello Experts,

    I am trying to integrate with a third party TAXII Server, I received the error as seen below. 

    Do i need to permit the TAXII Endpoint https://taxii.fsisac.com/ctixapi/taxii/ on my firewall?
    Please how can i troubleshoot this issue.?

    Thank You.

    ------------------------------
    benjamin Nworah
    ------------------------------

    Original Message


  • 6.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Wed March 10, 2021 04:29 PM
    It would appear that is the case.  I would suspect you have a firewall deny for that communication in your log activity tab.

    ------------------------------
    Scott Searls
    ------------------------------

    Original Message


  • 7.  RE: FSISAC threat intelligence Feed with QRadar

    Posted Wed March 10, 2021 04:43 PM
    Hello Scot,

    I will inform the client to permit the TAXII endpoint on their Firewall, and see if this works.

    Thank You.

    ------------------------------
    benjamin Nworah
    ------------------------------

    Original Message