This article follows Filigran's current TAXII Feeds documentation. TAXII access needs an Enterprise licence. Community, Plus and Premium use the CSV mapper path at the end of this page. Get credentials from Get your threat feeds.
Prerequisites
- OpenCTI: a running instance with permission to create ingestion feeds
- Q-Feeds: Enterprise TAXII username, password or Bearer token, and at least one collection UUID from the portal
- Network: outbound HTTPS from OpenCTI to
taxii.qfeeds.comon port 443 - Connector user: a dedicated OpenCTI user that will own objects from this source (Filigran best practice)
Q-Feeds values
| OpenCTI field | Value |
|---|---|
| TAXII server URL | https://taxii.qfeeds.com/default (API root, not discovery) |
| TAXII collection | Collection UUID from the portal, for example 426e3acb-db50-4118-be7e-648fab67c16c |
| Authentication type | Bearer token |
| Token | The Bearer token from your TAXII credentials |
| User responsible for data creation | The dedicated connector user |
| Import from date | Leave empty to import everything, or pick a start date |
Filigran warns that many ISACs hand out a discovery or collection URL. For Q-Feeds, do not paste https://taxii.qfeeds.com/taxii2/ or a /collections/{id}/ URL into TAXII server URL. Strip back to the API root /default.
Create the TAXII Feed
- In OpenCTI go to Data, Ingestion, TAXII Feeds.
- Create a feed. Name it so you can tell Q-Feeds collections apart, for example
Q-Feeds malware IP. - Set TAXII server URL to
https://taxii.qfeeds.com/default. - Set TAXII collection to the collection UUID (not the slug alias).
- Set authentication to Bearer token and paste the token.
- Assign the dedicated connector user as User responsible for data creation.
- Save and start the ingester. Repeat for each collection you subscribe to.
What an ingested indicator looks like
Q-Feeds sends atomic STIX 2.1 indicators: IPv4 and IPv6 addresses, domains, URLs and file hashes, with category and MITRE context where we have it. We do not send a full threat-actor or campaign graph. In Knowledge, search for an IP from the collection. The creator should be the connector user. The object type is Indicator, not Report.
CSV mapper fallback
If TAXII is not on the licence, use Data, Ingestion, JSON/CSV Feeds against the REST API. Community, Plus and Premium tokens work here. Example malware IP list:
https://api.qfeeds.com/api.php?feed_type=malware_ip&type=csv&api_token=YOUR_TOKENMap the CSV columns in OpenCTI's mapper to Indicator and the matching observable type. This path has no STIX context. Details of the API: IOC Lookup API & TAXII.
Troubleshooting
- 403 on the first poll: the token is not Enterprise, or it is a Community API token. TAXII and the REST API are different licences.
- Empty collection: you pasted discovery or a collection URL into TAXII server URL. Use the API root only, and the UUID in TAXII collection.
- Creator is "system": you left User responsible for data creation blank. Assign the connector user and re-run.
- No objects after a date: Import from date is in the future, or the collection UUID is for a feed you are not subscribed to.
- Support: support@qfeeds.com or the support page.