You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We're excited to announce the following new threat intelligence sources that allow you to collect TAXII feeds with greater ease. These sources are based on the underlying code of our STIX/TAXII 2 Client Source, but are tailored for each of the vendors to facilitate setup:
15
+
* CISA TAXII Client
16
+
* Dragos TAXII Client
17
+
* Nozomi TAXII Client
18
+
* Recorded Future TAXII Client
19
+
* Unit42 TAXII Client
20
+
21
+
When you set up a source, search for "taxii" and select the tile for the source you want to install:<br/><img src={useBaseUrl('img/security/taxii-sources.png')} alt="TAXII sources" style={{border: '1px solid gray'}} width="800" />
Copy file name to clipboardExpand all lines: docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/stix-taxii-2-client-source.md
+15-2Lines changed: 15 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,6 +70,19 @@ To configure a TAXII 2 Client Source:
70
70
1. (Optional) **Polling Interval**. Set how frequently to poll for new or updated indicators. It must be between 5 minutes and 48 hours.
71
71
1. When you are finished configuring the Source, click **Save**.
72
72
73
+
### TAXII 2 sources
74
+
75
+
Sumo Logic provides the following sources based on the underlying code of our STIX/TAXII 2 Client Source, but tailored for each of the vendors to facilitate setup:
76
+
* CISA TAXII Client
77
+
* Dragos TAXII Client
78
+
* Nozomi TAXII Client
79
+
* Recorded Future TAXII Client
80
+
* Unit42 TAXII Client
81
+
82
+
When you set up a source, search for "taxii" and select the tile for the source you want to install:<br/><img src={useBaseUrl('img/security/taxii-sources.png')} alt="TAXII sources" style={{border: '1px solid gray'}} width="800" />
83
+
84
+
Although we recommend these sources to get feeds from these vendors, you can instead set up JSON configurations. See [Recommended configurations](#recommended-configurations) below.
85
+
73
86
## JSON Configuration
74
87
75
88
Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [Use JSON to Configure Sources](/docs/send-data/use-json-configure-sources) for details.
Below is a list of Sumo Logic recommended configuration examples for specific threat intel vendors using TAXII 2.
124
+
Below is a list of additional Sumo Logic recommended configuration examples for specific threat intel vendors using TAXII 2.
112
125
113
126
| Vendor | Notes |
114
127
| :-- | :-- |
115
-
| <ahref="/files/c2c/taxii-2/cisa-dhs-config.json"target="_blank">CISA DHS Automated Indicator Sharing (AIS)</a> | No authentication setup is required. Sumo Logic uses it's own certificates for authentication. |
128
+
| <ahref="/files/c2c/taxii-2/cisa-dhs-config.json"target="_blank">CISA DHS Automated Indicator Sharing (AIS)</a> | No authentication setup is required. Sumo Logic uses its own certificates for authentication. |
116
129
| <ahref="/files/c2c/taxii-2/cybersixgill-config.json"target="_blank">Cybersixgill</a> | Be sure to specify collection `102` in the configuration. |
0 commit comments