This article follows EclecticIQ's Incoming feed, TAXII 2.1 poll documentation. TAXII needs an Enterprise licence. Credentials: Get your threat feeds.
Prerequisites
- EclecticIQ Intelligence Center: permission to create Incoming feeds
- Q-Feeds: Enterprise TAXII username and password
- Network: outbound HTTPS to
taxii.qfeeds.comon port 443
Q-Feeds values
| EclecticIQ field | Value |
|---|---|
| Transport type | TAXII 2.1 poll |
| Content type | STIX 2.1 |
| Auto Discovery | https://taxii.qfeeds.com/taxii2/ |
| API Root URL | https://taxii.qfeeds.com/default |
| Collection ID | Collection UUID from discovery or the portal |
| Basic authentication | On; TAXII username and password |
| Extra HTTP headers | Accept: application/taxii+json;version=2.1 if the poll returns 406 |
| Objects per run (max) | Default 100; raise it for a large collection |
| Download time frame | Advancing after the first full pull |
Enable Basic authentication before you search Auto Discovery. A discovery URL that requires auth will otherwise look empty.
Create the Incoming feed
- Create or edit an Incoming feed.
- Under Transport and content, set TAXII 2.1 poll and STIX 2.1.
- Turn on Basic authentication and enter the Q-Feeds TAXII username and password.
- In Auto Discovery, enter
https://taxii.qfeeds.com/taxii2/and search. Pick the collection. API Root URL and Collection ID should fill in. - If they do not, paste API Root URL
https://taxii.qfeeds.com/defaultand the collection UUID yourself. - Add the Accept header under Extra HTTP headers if needed.
- Set Execution schedule and Objects per run. Save and run once.
Do not pick TAXII 2.1 inbox. Inbox starts a collection that listens for POST. Q-Feeds does not push into your OpenTAXII.
What an ingested indicator looks like
Q-Feeds sends atomic STIX 2.1 indicators (IPs, domains, URLs, hashes). Intelligence Center stores them as entities/observables. Search for an IP from the collection after the first successful run. You will not see threat-actor or campaign objects from this source.
Troubleshooting
- Discovery is empty: Basic was off, or you used the API root in Auto Discovery. Discovery is
/taxii2/. - 406 Not Acceptable: add
Accept: application/taxii+json;version=2.1. - 403: the credentials are not Enterprise.
- Tiny batches: Objects per run is still 100. Raise it, then leave Download time frame on Advancing.
- Support: support@qfeeds.com or the support page.