IBM Security QRadar

 View Only

Adding threat intelligence feeds

  • 1.  Adding threat intelligence feeds

    Posted Tue March 28, 2023 02:38 PM

    Hi,

    After I installed QRadar 7.3.3 CE and threat intelligence app, I tried to add threat intelligence feeds via Admin -> Apps -> Threat Intelligence -> STIX/TAXII Configuration. Note, there is no Feed Downloader in Threat Intelligence dashboard, due to the different version of QRadar? the Qadar CE is 7.3.3

    1. From the navigation menu on the Threat Intelligence dashboard, click the Feeds Downloader icon (Icon for Feeds Downloader).
    2. Click Icon for downloadAdd Threat Feed, and then click Add TAXII Feed.

    The documents/instructions: https://www.ibm.com/docs/en/qradar-common?topic=tif-adding-threat-intelligence-feeds

    My question is that, in STIX/TAXII Configuration, I was able to config the Taxii service we hosted ourselves, then pull the Threat Intelligence Feeds, but the feed I configed and pulled are not shown on Threat Intelligence Dashboard.  Can someone advise where the collection/feeds I configured and pulled can be displayed in Threat Intelligence Dashboard?  Right now, it only displays the IBM exchange public collections and advanced Threat Protection Feeds... 

    Configured Threat Intelligence Feeds



    ------------------------------
    Tony Zhu
    ------------------------------