How to integrate the third party custom intelligence feed stix and TAXII in SA?

[RSAAdmin]

Hi ,

In SA ,How  do we integrate the third party intelligence feeds  stix ,taxill and CybOX.

Is it possible to create custom feeds for the same?

Regards

Shanthi

[ChristopherAhea · Accepted solution]

Currently, the data would need to be converted into a CSV format.  Then, you can create the feed using the Feed Wizard in SA or write your own custom feed definition xml file.

[RSAAdmin]

I've also been told ECAT can import stix and taxiIl. Only in the 4.1 version.

We have not tried yet.

[MatthewGardiner]

Yes....this is correct regarding ECAT and STIX.  Can import it directly.

[huanzhou1]

Since SA 10.6.1, it can do STIX. 

[EricPartington]

10.6.4 has updated STIX capabilities.  Check the release notes for more information