Configuring a custom or third-party feed

This section explains how to configure a custom or third-party feed.

Changing the settings of a custom or third-party feed

To change the settings of a custom or third-party feed:

1. On the Feeds page, select the tab that contains the feed you need to configure.

   You cannot change the settings for the Internal TI supplier.

2. Click the button of the feed that you want to modify.
3. In the Edit custom {{format}} feed window that opens, make any necessary changes.
4. Click Save.

You can change most settings of a custom or third-party feed, except the feed type. For example, you cannot change a CSV feed to JSON.

Adding new fields to a custom or third-party feed

If a new field or fields have been added to your custom or third-party feed, and you want Kaspersky CyberTrace to start using these new fields:

• For a CSV, JSON, or XML feed, follow the procedure outlined above in subsection "Changing the settings of a custom or third-party feed," to open the Edit custom {{format}} feed window. Then, add each new field by clicking the Add rule button, and then specify the values described above in "Step 2. Choosing feed fields to be used for matching."

  If you do not specify any new fields for a feed, the feed will contain them, but they will not be displayed in the Available fields subsection and will not be used in the matching process.

• For a STIX feed, click the feed name and, in the Available fields subsection, select any new field or fields that must be used by Kaspersky CyberTrace, and then click Save. Learn more about filtering rules.

Deleting a custom or third-party feed

To delete a custom or third-party feed:

1. On the Feeds page, select the tab that contains the feed you need to delete.

   You cannot delete the Internal TI supplier.

2. Click the button of the feed that you want to delete, and then click Delete.

Page top