Feeds

Security analysts often need to create custom threat intelligence to capture their findings about threat investigations. These findings can be recorded as lists of malicious, suspicious, or clean observables (block lists, watch lists, and allowed lists). These lists can then be saved and updated as data feeds.

Security products can be configured to consume these feeds and have policies around each type of feed—for example, a firewall could consume a list of known bad IP addresses and block connection attempts to those IPs. Feeds allow analysts to gather, curate, and ultimately publish lists of observables that are interesting or meaningful, and related in some way.

The Cisco XDR Intelligence feature allows you to create these custom feeds for continuous gathering of observables, and to share them with other technologies or users via the feed URL. A feed can be a simple list of observables, one per line, or a list of detailed judgments (including the observable) in JSON format. These feeds are created and managed in the Feeds tab on the Intelligence page.

The Feeds list includes the custom feeds that have been created, including the name, what it contains, the date and time it was created, who created it, and the date and time it expires.

Feeds Table Column Descriptions

Column Name	Description
Title	The name and description of the feed. Click the feed Title to open the Feed Details drawer and view additional information, and edit or delete the feed.
Output	What is included in the output for the feed URL (Observables or Judgments).
Modified	The date and time the feed was created or updated. Click the (Sort) icon next to the Modified column to sort by oldest or most recent date and time.
Creator	The user who created the feed URL.
Expiration	The lifetime of the feed, which is specified when it is created. If a specific date is included when the feed is created, it displays how many days from the current date the feed will expire.

Create Feed URL

Before you can create a feed URL, you need the indicator that will serve as the data collection mechanism for the feed. The selected indicator is then the driving factor for feed generation—the feed will include all observables that have had that indicator applied via judgments. You can use any existing indicator in your private intel store or create a new one for this purpose (see Create Private Indicator). This indicator should be as descriptive as possible, and the title should make it clear that it drives population of a feed.

You can add observables to any feed that you have created using the Create Judgment option on the Pivot menu next to the observable. You add a judgment for the observable and then associate the appropriate indicators (see Create Private Judgment). The feed is then automatically updated to include the observable. The next time any user or device downloads the feed, it will include the newly-added observable or judgment.

Once you have an indicator ready, you can create the feed URL.

Choose Intelligence in the navigation menu and click the Feeds tab.
Click Create feed URL in the upper right corner to open the drawer.

Complete the form:

Field	Description
Title	Required. Enter a descriptive title for the feed.
Indicator	Required. Click the drop-down list and choose the indicator that contains the list of observables to be saved in the feed URL. The indicator is the mechanism for populating the feed with data; when you create a judgment on an observable and assign it to an indicator, the judgment and observable are tied to the feed that includes this indicator.
Output	From the drop-down list and choose Observables or Judgments as the output for the feed URL.
Expiration	By default, feed URLs are set to never expire. If you want to specify an expiration date, uncheck the Never expires check box and pick a date on the calendar.

Click Create.

The newly added feed is displayed in the Feeds tab.

Each feed has a URL, which has an authorization token built into it that allows other products to use the contents of the feed without having to authenticate with Cisco XDR.

Note: Because the feed can be reached without authenticating in Cisco XDR, anyone who has access to the URL can use it.