This guide follows CIRCL's Managing feeds documentation. Feeds work on every Q-Feeds licence, including the free Community edition; see the licensing model. Credentials: Get your threat feeds.
Prerequisites
- MISP: a running instance, and an account that can reach Sync Actions
- Token: a Community, Plus, Premium or Enterprise API token
- Network: outbound HTTPS to
api.qfeeds.comon port 443
No modules are involved. MISP's own feed system does the fetching and parsing, so there is nothing to install on the server.
Check the file before you configure anything
Open your feed URL in a browser first. You will see the plain list MISP is going to parse, and you can count which column holds the value you want. That column number is the one setting people most often get wrong.
https://api.qfeeds.com/api.php?feed_type=malware_ip&type=csv&api_token=YOUR_TOKEN
Swap malware_ip for malware_domains or malicious_urls to get the other lists. Each list is its own feed in MISP, so add them one at a time. The full parameter table is in IOC Lookup API & TAXII.
Add the feed
Go to Sync Actions, List Feeds, then Add Feed in the side menu. The form shows and hides fields depending on what you pick, so set Source Format early.
| Field | Value |
|---|---|
| Enabled | Ticked |
| Caching enabled | Ticked, so you can correlate before you import |
| Name / Provider | Something you will recognise later, for example Q-Feeds malicious IPs and Q-Feeds |
| Input Source | Network |
| URL | Your feed URL, including the api_token |
| Source Format | Simple CSV Parsed Feed (use Freetext Parsed Feed for the plain text lists) |
| Value field(s) in the CSV | The column number holding the indicator, comma separated if there is more than one |
| Delimiter | , |
| Exclusion Regex | Optional, useful if the file starts with a comment line |
| Target Event | Fixed Event, so the list lands in one event instead of a new one per fetch |
| Delta Merge | Ticked, so indicators that leave the feed are removed again |
| Auto Publish | Your call; leave it off if you want to review before the event is shared |
| Default Tag | Optional, a tag such as block-or-filter-list makes these events easy to separate later |
Submit, then use Fetch next to your new feed to pull it for the first time. Nothing arrives until you do this once by hand.
Keep it current
The first fetch is manual, the rest should not be. Under Administration, Scheduled Tasks, set the feed fetch task to a frequency that suits you. Q-Feeds refreshes every 20 minutes, so anything from hourly upwards keeps you close to current without hammering the API.
Import, or only correlate
These are two different things and the distinction matters if you care about database size.
- Fetch imports the indicators as attributes on your target event. They behave like any other attribute and correlate normally.
- Cache stores the feed in Redis instead. MISP shows you the overlap with your own events without adding anything to your database.
Caching is the lighter option and a good way to see how often Q-Feeds hits your data before you commit to importing. If you cache, check Lookup Visible on the feed so correlations show up for the rest of your team and not just for you.
What an ingested indicator looks like
Each row becomes a MISP attribute of the type your column mapping implies: ip-src or ip-dst for the IP lists, domain for malware domains, url for malicious URLs. Correlation then links those values to events your team already created.
Troubleshooting
- Nothing after a fetch: open the feed URL in a browser. If it returns an error rather than a list, the token is wrong or expired.
- Attributes of the wrong type: the value field points at the wrong column. Recount from the file itself, and remember the count starts at 1.
- The event grows on every fetch: Delta Merge is off, or Target Event is set to New Event Each Pull.
- A comment line becomes an attribute: add an Exclusion Regex for lines starting with
#. - Data stopped updating: the scheduled fetch task is not enabled. The first fetch being manual catches a lot of people out.
- Support: support@qfeeds.com or the support page.