ThreatStream consumes third-party TAXII as a site then a feed. The same sequence is documented by other feed vendors (for example ReversingLabs). TAXII needs an Enterprise licence. Credentials: Get your threat feeds.
Prerequisites
- ThreatStream: permission to add TAXII sites and feeds (or STAXX if you are not on ThreatStream yet)
- Q-Feeds: Enterprise TAXII username and password
- Network: outbound HTTPS to
taxii.qfeeds.comon port 443
Q-Feeds values
| ThreatStream field | Value |
|---|---|
| Discovery URL | https://taxii.qfeeds.com/taxii2/ |
| TAXII version | TAXII 2.1 |
| Username / password | HTTP Basic from your Enterprise credentials |
| API root (if asked) | https://taxii.qfeeds.com/default |
| Collection | UUID listed after the site connects |
| Poll interval | The cadence you set on the feed; Q-Feeds refreshes every 20 minutes |
This is ThreatStream as a client. Do not configure Q-Feeds against ThreatStream's own TAXII server (the saved-search collections that other tools pull from Anomali).
Add the TAXII site
- In ThreatStream go to Settings and add a TAXII site.
- Paste the discovery URL
https://taxii.qfeeds.com/taxii2/. - Set the version to TAXII 2.1.
- Enter the Basic username and password. Save.
- Confirm the site lists collections. If it does not, the credentials or version are wrong.
Add a TAXII feed per collection
- Create a TAXII feed bound to the site you just saved.
- Pick one collection. Name the feed so you can tell collections apart.
- Set the poll interval.
- Save and wait for the first poll.
- Repeat for each extra collection. One feed does not ingest every collection on the site.
STAXX
STAXX is Anomali's free TAXII client. Point it at the same discovery URL with Basic auth if you want to test Q-Feeds before you have a ThreatStream tenant. The collections and credentials are identical.
What an ingested indicator looks like
Q-Feeds sends atomic STIX 2.1 indicators. ThreatStream stores them as observables (IP, domain, URL, hash). Search for an IP from the collection after the first poll. Source should be the feed name you chose. You will not see actor or campaign objects from this source.
Troubleshooting
- No collections on the site: version is not 2.1, or Basic failed. Q-Feeds is TAXII 2.1 only.
- 403: the credentials are not Enterprise.
- Feed is empty: you skipped the site, or you picked a collection you are not subscribed to.
- You configured Anomali's outbound TAXII: that publishes ThreatStream data. Delete it and add Q-Feeds as an inbound site instead.
- Support: support@qfeeds.com or the support page.