Taxii API Feeds

aalhabbash1 — Mon, 20 May 2019 12:02:17 GMT

Hi splunker;

I want to pull feeds from (https://otx.alienvault.com/taxii/discovery) url for Taxii feeds, and I have got the API key from (https://www.alienvault.com/blogs/security-essentials/otx-is-now-a-free-stix-taxii-server), and this kind of feeds splunk can't monitor url by use threat intelligent or rest API app, because the url which i want to monitoring don't work on browser, I think for pull this feeds must connect by connector (API).

Please how can pull these feeds to splunk?

Best Regards;
Abdullah Al-Habbash

Re: Taxii API Feeds

vikramyadav — Mon, 20 May 2019 16:15:27 GMT

Hi @aalhabbash1
you can use curl to onboard the logs curl https://otx.alienvault.com:443/api/v1/pulses/subscribed?page=1 -H "X-OTX-API-KEY: "

In fact, you can use "Rest API Modular input app " to pull data into Splunk.