Taxii API Feeds

[aalhabbash1]

Hi splunker;

I want to pull feeds from (https://otx.alienvault.com/taxii/discovery) url for Taxii feeds, and I have got the API key from (https://www.alienvault.com/blogs/security-essentials/otx-is-now-a-free-stix-taxii-server), and this kind of feeds splunk can't monitor url by use threat intelligent or rest API app, because the url which i want to monitoring don't work on browser, I think for pull this feeds must connect by connector (API).

Please how can pull these feeds to splunk?

Best Regards;
Abdullah Al-Habbash

[vikramyadav]

Hi @aalhabbash1
you can use curl to onboard the logs curl https://otx.alienvault.com:443/api/v1/pulses/subscribed?page=1 -H "X-OTX-API-KEY: "

In fact, you can use "Rest API Modular input app " to pull data into Splunk.