IBM X-Force Exchange Integration

IBM X-Force Exchange is a cloud-based threat intelligence platform that allows you to consume, share and act on threat intelligence. It enables you to rapidly research the latest global security threats, aggregate actionable intelligence, consult with experts and collaborate with peers. IBM X-Force Exchange, supported by human- and machine-generated intelligence, leverages the scale of IBM X-Force to help users stay ahead of emerging threats.

  1. In the Cisco XDR navigation menu, choose Administration > Integrations.

  2. On the Integrations page, click the Third-Party tab and navigate to the IBM X-Force Exchange integration.

  3. Click the plus sign (+) in the lower-right corner of the card. The IBM X-Force Exchange integration page is displayed.

  4. Expand the Integration Guide area and follow the instructions on how to add the IBM X-Force Exchange integration in Cisco XDR.

You can perform the following task after you integrate IBM X-Force Exchange with Cisco XDR:

  • Investigations - Start a new investigation into any combination of IP addresses, IPv6 addresses, domains, MD5 hashes, SHA-1 hashes, and SHA-256 hashes and the results will include any records of them found in your IBM X-Force Exchange. To verify that this integration is working, and to see what kind of data is returned, investigate one of more observables about which you know IBM X-Force Exchange has recent information. For details, see Investigate.

  • Pivot Menu - Use the Pivot menu to access actions in IBM X-Force Exchange. Available actions include searching for a hash in IBM X-Force Exchange.