Create a Feed and Feed URL

Before you can create a feed URL, you need the indicator that will serve as the data collection mechanism for the feed. You can use any existing indicator in your private intel store or create a new one for this purpose (see Create Private Indicator). This indicator should be as descriptive as possible, and the title should make it clear that it drives population of a feed.

Once you have an indicator ready, you can create the feed URL.

Create a Feed URL

1. Choose Intelligence > Feeds in the navigation menu.

2. Click Create Feed URL in the upper right corner to open the drawer.



3. Complete the form:

   Field	Description
   Title	Required. Enter a descriptive title for the feed.
   Indicator	Required. Click the drop-down list and choose the indicator that contains the list of observables to be saved in the feed URL. The indicator is the mechanism for populating the feed with data; when you create a judgment on an observable and assign it to an indicator, the judgment and observable are tied to the feed that includes this indicator.
   Output	Click the drop-down list and choose Observables or Judgments as the output for the feed URL.
   Expiration	By default, feed URLs are set to never expire. If you want to specify an expiration date, uncheck the Never expires check box and pick a date on the calendar.

4. Click Create.

   The newly added feed is displayed on the Feeds page.

   Each feed has a URL, which has an authorization token built into it that allows other products to use the contents of the feed without having to authenticate with Cisco XDR.

   Note: Because the feed can be reached without authenticating in Cisco XDR, anyone who has access to the URL, can use it.