Runbook Enriching with Threat Intelligence Information
Also available as:
PDF

Fetch Hail a TAXII Feeds

After you install your TAXII provider, you must fetch the latest Hail a TAXII feeds into the TAXII server. Hail a TAXII.com is a repository of Open Source Cyber Threat intelligence feeds in STIX format.

Set up your TAXII provider. Refer to your TAXII provider documentation for more information.
  1. Fetch the lastest Hail a TAXII feeds into the TAXII server:
    service opentaxii sync <service-name> [YYYY-MM-DD]
    For example:
    service opentaxii sync guest.phishtank_com 
    service opentaxii sync guest.Abuse_ch 2016-08-01
    Note
    Note
    The date (YYYY-MM-DD) indicates the time from when the threat intel feeds is to be pulled. If not suffixed, then the sync command picks up feeds available for the current day.
  2. Repeate Step 1 for all subscribed services.