Enabling and disabling feeds

This section describes how to enable and disable feeds.

When you enable a feed, it is automatically added and enabled in all tenants. When you disable a feed, it is automatically removed from all tenants.

Enabling and disabling feeds

You can enable or disable feeds, except for the InternalTI supplier on the Internal TI tab, by using the Feed is off or Feed is on toggle button. For the InternalTI supplier on the Internal TI tab, you can only specify actionable fields.

If you disable a feed, its indicators will not be removed from the indicator database. These indicators will not be displayed on the Indicators tab, but will be taken into consideration regarding the limit on the number of indicators. To avoid that, you must remove the indicators manually before disabling the feed.

When only demo feeds are used, there is a notification at the top of the Feeds tab. Use the Request access to all feeds link in that notification to send your request by email. Alternatively, you can use the Request Kaspersky Threat Intelligence form to subscribe to Kaspersky Threat Intelligence Portal and get commercial feeds, which have a higher level of protection.

Enabling or disabling a feed

Page top