{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45626,"path":"security-management/threat-intelligence-security-center/tisc-new-data-source.md","title":"Configure a new threat intelligence feed","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure a new threat intelligence feed\n\nConfigure a new threat intelligence feed.\n\n## Before you begin\n\nRole required: sn\\_sec\\_tisc.admin\n\nTo configure a new threat intelligence feed, follow the procedure:\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Workspaces** &gt; **Threat Intelligence Security Center**.\n\n2.  Click on **Integrations** icon.\n\n3.  Select **Threat Intel Feeds** &gt; **All Feeds**.\n\n4.  Select **Configure new source**.\n\n    The various feed types are displayed.\n\n    \\[Omitted image \"tisc-all-feeds-new-source.png\"\\] Alt text: TISC All Feeds - Configure new source\n\n5.  Select the respective feed type.\n\n6.  On the form, fill in the fields.\n\n<table id=\"table_z5f_tqd_pyb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nEnter a name for the feed.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nDescription of the feed.\n\n</td></tr><tr><td>\n\nFeed Type\n\n</td><td>\n\nThe feed type. For example, MISP.By default, this value is displayed based on the type of feed that you selected from the Catalog.\n\n</td></tr><tr><td>\n\nLogo\n\n</td><td>\n\nAttach the logo of the source feed.**Note:** The size should be 72px/72px.\n\n</td></tr><tr><td>\n\nIndustry\n\n</td><td>\n\nSelect the industry category such as Aerospace, Agriculture, and so on for which the feed is applicable to.\n\n</td></tr><tr><td>\n\nSource Type\n\n</td><td>\n\nSelect the type of source from the list of available source types. List of available sources are:-   Government\n-   ISACs\n-   Open Source\n-   Premium Source\n-   Other Source\n\n\n</td></tr></tbody>\n</table>7.  Select **Select**.\n\n8.  Fill in the fields in the Configuration section, as appropriate.\n\n<table id=\"table_czj_zqd_pyb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nExpiry period \\(days\\)\n\n</td><td>\n\nEnter the expiry period for the feed in days. For example, 180 days.**Note:** Data that is ingested from the source will be expired 180 days after the ingestion.\n\n</td></tr><tr><td>\n\nOverride Source Expiration\n\n</td><td>\n\nWhen enabled, the feed record received will have its expiration time overridden to match the profile’s configuration.\n\n</td></tr><tr><td>\n\nUse REST Message\n\n</td><td>\n\nSelect **Use REST Message** check box if you need to use REST Message/REST Method functionality that is provided by ServiceNow AI Platform.If this check box is not selected, then the application uses the endpoint provided in **REST Endpoint URL** to fetch the data from the feed. For more information, see [Outbound REST web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/c_OutboundRESTWebService.md) on ServiceNow AI Platform documentation.\n\n**Important:** The REST message and REST method fields are mandatory when you select REST message.\n\n</td></tr><tr><td>\n\nREST Message\n\n</td><td>\n\nSelect the REST Message record from the list of REST message records which are already configured in the instance. For more information, see [Outbound REST web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/c_OutboundRESTWebService.md) on the ServiceNow AI Platform documentation.**Note:** Select this value when you need to view specific headers, and define the REST related records using the REST message option.\n\n</td></tr><tr><td>\n\nREST Method\n\n</td><td>\n\nSelect REST Method from the list of available REST Methods configured for the selected REST Message. For more information, see [Outbound REST web service](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/c_OutboundRESTWebService.md) on the ServiceNow AI Platform documentation.\n\n</td></tr><tr><td>\n\nREST endpoint URL\n\n</td><td>\n\nEnter the REST endpoint URL where the data is hosted by the threat intelligence feed.**Note:** For MISP feed types, the REST endpoint URLs that end with `/manifest.json` are supported.\n\n</td></tr><tr><td>\n\nConfidence\n\n</td><td>\n\nSet the confidence for all the applicable records that are ingested through this specific feed.**Note:** Set the confidence between 0-100 for this source.\n\n</td></tr><tr><td>\n\nOverride Source Confidence\n\n</td><td>\n\nWhen enabled, the feed will have its confidence value overridden to match the profile’s configuration.\n\n</td></tr><tr><td>\n\nData Parsing Mechanism\n\n</td><td>\n\nSelect the appropriate data parsing mechanism option. The available options are:-   **Automated IoC Extraction**: This option is selected by default when configuring Text, CSV, or JSON feeds.\n-   **Custom Field Mapping**: Select this option if you want to define how the specific fields in your feed data should be mapped to the observable attributes.\n\nOnce selected, you can configure the mappings in the **Field Mapping** section. For more detailed information on the custom field mapping, see [Configure Custom Field Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-field-mapping.md).\n\n**Note:** The data parsing mechanism option is only available for Text, CSV, and JSON feeds, where the feeds **Report Processor** is set to `SimpleFeedDatasourceResponseProcessor`.\n\n</td></tr><tr><td>\n\nAuthentication Required\n\n</td><td>\n\nSelect this check box if authentication is required for your new threat intelligence feed.**Note:** This is only applicable when REST Endpoint URL is being used to retrieve the data.\n\n</td></tr><tr><td>\n\nAuthentication Type\n\n</td><td>\n\nThe authentication type for the source feed. Following are the authentication types that are configured and provisioned within the base system for the users:-   API ID / API Key\n-   API ID / API Secret\n-   API Key\n-   API Key / API Secret\n-   API Username / API Password / API Key\n-   Basic Authentication\n\n\n</td></tr><tr><td>\n\nHeaders to be passed with request\n\n</td><td>\n\nAny headers to be passed with the requests can be provided in Request Header Mapping.-   Header should be provided in key-value pair separated by colon\\(':'\\).\n-   Each header key value pair should be provided in a new line.\n-   For providing authentication parameters as header values, enclose the required Authentication Label with '$\\{' and '\\}$'. For example, x-api-key:$\\{API Key\\}$.\n\n\n</td></tr><tr><td>\n\nAdvanced\n\n</td><td>\n\nSelect this check box to define custom integration script and report processor script.**Note:** When you select this check box, the **Integration script** and **Report Processor** fields will appear for you to select the custom scripts.\n\n</td></tr><tr><td>\n\nIntegration script\n\n</td><td>\n\nIntegration script invokes a call to the REST Endpoint URL using the authentication parameters and the headers as configured in the feed, and then the script fetches the data that is available from the specific feed.Within the base system following are the custom scripts includes available, which are provisioned within the application for the integrations scripts:\n\n-   MITRESourceIntegration: Used for fetching the data from MITRE feeds.\n-   RSSFeedDatasourceIntegration: Used for fetching the data from RSS feeds.\n-   SimpleFeedDatasourceIntegration: Used for fetching the data from Simple feeds without authentication or Basic Authentication.\n-   SimpleMISPFeedDatasourceIntegration: Used for fetching the data from hosted MISP feeds.\nThe default integration script is based on the feed type that you select. For example, if you select MISP feed type which is a standard format to process and fetch the data then the integrations script is **SimpleMISPFeedDatasourceIntegration**.\n\n**Note:**\n\nFor the Custom integration scripts, you can create a script include by extending **FeedDatasourceIntegrationBase** and override the required methods.\n\n</td></tr><tr><td>\n\nReport processor\n\n</td><td>\n\nThe report processor script processes data fetched from the feed using the integration script.\n\n The base system includes the following custom scripts, which are provisioned within the application to support report processor script:\n\n-   AtomFeedDatasourceResponseProcessor: Used for processing RSS feeds in Atom format.\n-   MITRECollectionDataProcessor: Used for processing MITRE feeds.\n-   RSSFeedDatasourceResponseProcessor: Used for processing RSS feeds.\n-   SimpleDataplaneFeedResponseProcessor: Used for processing Dataplane feeds.\n-   SimpleFeedDatasourceResponseProcessor: Used for processing Simple feeds using regular expression extraction of observables.\n-   SimpleFeodotrackerFeedResponseProcessor: Used for processing Feodotracker feeds.\n-   SimpleMISPFeedDatasourceResponseProcessor: Used for processing hosted MISP feeds.\n-   TAXIIV2CollectionDataProcessor: Used for processing TAXII Collection data.\n The default report processor for MISP feeds is `SimpleMISPFeedDatasourceResponseProcessor`. This processor is preconfigured by the application and cannot be modified or replaced.\n\n</td></tr></tbody>\n</table>9.  Fill in the fields in the Scheduling section, as appropriate.\n\n<table id=\"table_yt1_rrd_pyb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nRun\n\n</td><td>\n\nSet the frequency at which you want to ingest the records. The feed will run and execute based on the scheduled job interval. The available job intervals are:-   Daily\n-   Weekly\n-   Monthly\n-   Periodically\n-   Once\n-   On Demand\n-   Business Calendar: Entry Start\n-   Business Calendar: Entry End\n**Note:** By default, the frequency is set to On Demand.\n\n For more information, see [Scheduled Jobs and how to Automatically run a script of your choosing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/t_ScheduleAScriptExecution.md).\n\n</td></tr><tr><td>\n\nFetch Data From\n\n</td><td>\n\nThe start date from when the data needed to be fetched. This field should be set with the time from when the data needs to be ingested from the corresponding source. Once this value is s, the next ingestion run would fetch the data from the configured time and consecutive ingestion runs would fetch incremental Data based on the Run frequency?.For example, Source is scheduled to ingest the data every hour. The user sets **Fetch Data From** to Jan 12 6:00AM on Jan 12 9:30AM, the ingestion triggering on Jan 12 10:00AM would fetch the data from Jan 12 6:00AM to Jan 12 10:00AM. The next ingestion that triggers at 11:00AM would fetch only the incremental data from Jan 12 10:00AM to Jan 12 11:00AM.\n\n**Note:** This means the scheduled runs will fetch data incrementally starting from the specified date onwards.\n\n**Important:** Also, this is not applicable for Text, CSV, and JSON feeds.\n\n</td></tr></tbody>\n</table>    |Field|Description|\n    |-----|-----------|\n    |Media URL|Indicates the feed URL.|\n    |Feed Comments URL|The link provided by the RSS source.|\n\n    |Field|Description|\n    |-----|-----------|\n    |Select TISC Tags|Use the tags to annotate or earmark records that are ingested into the system from this source. Start entering the tag name in the **Search** bar to choose the available tags in the application or enter new tag name and click **Add** to assign it to the source.|\n\n10. Select the **Save** action to store and create the feed.\n\n    The provided details are validated, and by default the feeds status is disabled.\n\n11. Select the **Save as Draft** action to only store the feed configurations as draft.\n\n    Users cannot enable a feed when it is saved in draft. i Use the **Save as Draft** option if you're unsure about the configuration details. After you get the configuration details, you can fill the remaining information in the draft version and create it.\n\n12. Select **Enable** to enable the record.\n\n    After the threat intelligence feed record is enabled, you can execute the record to run the integration.\n\n    **Note:**\n\n    -   The threat intelligence feed record is labeled and indicated as **enabled**. Similarly, you can disable the threat intelligence feed by clicking **Disable** button.\n    -   You can also enable, disable, or delete a particular feed by using the **Actions** menu of the required feed tile on the **Catalog** or **Threat Intel Feeds** page.\n13. Select select **Delete** to delete the threat intelligence feed record.\n\n14. Select **Integrations Run** section to verify the run details.\n\n    **Note:** The threat intelligence feed configuration procedure is same for all other threat intelligence feed types, except for STIX TAXII. For more information on how STIX TAXII is configured, see [Configure a new TAXII Feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-configure-a-new-taxii-feed.md).\n\n\n**Parent Topic:**[Threat Intelligence Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/threat-intelligence-feeds.md)\n\n"}}