Generating Your Own Threat Intelligence Feeds in ThreatStream

February 14, 2018 | David Greenwood

Getting threat intelligence into your existing security products - SIEMs, endpoints, network tools -- can significantly enhance their effectiveness and longevity. Here at Anomali we understand the value of product integrations, so much so that my entire job is to manage the 30+ we currently offer.

Recently we launched a feature that allows you to create your own threat intelligence feeds in CSV, JSON and STIX format for consumption by other products. They're super simple to setup...

Step one: Create a saved search

Use ThreatStream's search functionality to define the type of indicators you want to include in your feed. I used the search:

(itype="mal_domain") and (status="active") and (confidence>=95)

Translated into English; only include malware domain indicators type that are currently reported as active with a very high confidence score of 95 assigned by ThreatStream.

Once the constraints meet the requirements for your feed, select "save as" to convert it into a saved search you can use across ThreatStream.

Step two: Create a custom integration

In ThreatStream navigate to: Settings > Integrations > New Integration

The pop-up modal will allow you to configure the settings for your feed including:

  • The search filter (set in step one)
  • The feed format (JSON, CSV or STIX)
  • The fields to be included in the feed (35 available to select)

Once you hit save, ThreatStream will create a custom URL for your feed.

Step three: Add your feed to your existing products

You can now use the URL generated in step two as a feed source to any products that can ingest threat feeds in the configured format. 

The feed is updated on a set schedule (every 4 hours in the example above). If you're asked for a polling interval make sure to set it equal to this schedule so you're not making more requests than necessary.

Here's an example using Splunk's Enterprise Security Threat Intel Download input. In the screenshot above, I've created an input for my ThreatStream CSV threat feed. Once active, the indicators will be consumed by Splunk ES and used for log enrichment within the app.

My product does not support CSV, JSON or STIX inputs...

There are currently 30+ native integrations supported by ThreatStream -- Splunk, QRadar, Arcsight, Carbon Black, Palo Alto Networks

Trying to do integrate with a product that's a little more niche? Let us know on the Anomali forum.

David Greenwood
About the Author

David Greenwood

David is a Product Manager at Anomali. He's responsible for developing and executing strategy for integrations to and from the ThreatStream platform, working closely with Anomali customers to help them realize the value that threat intelligence can deliver to their business.

Get the latest threat intelligence news in your email.