Configuring a custom or third-party feed

This section explains how to configure a custom or a third-party feed. Make sure that the General tenant is selected from the drop-down list that has all available tenants, in the upper-left area of the window.

Changing the settings of a custom or third-party feed

To change the settings of a custom or third-party feed:

1. In the Filtering rules for feeds section, select the tab that contains the feed you need to configure.

   You cannot change the settings for the Internal TI supplier.

2. Click the name of the feed that you want to modify, and then click Edit.

   

   Editing a custom or third-party feed

3. In the Edit custom feed window that opens, make any necessary changes.
4. Click Save.

You can change all the settings of a custom or third-party feed, except the feed type. For example, you cannot change a CSV feed to JSON.

Adding new fields to a custom or third-party feed

If a new field or fields have been added to your custom or third-party feed being used, and you want Kaspersky CyberTrace to start using these new fields, do the following:

• For a CSV, JSON, or XML feed, follow the procedure outlined in subsection "Changing the settings of a custom or third-party feed" above, to open the Edit custom feed window. Then add each new field by clicking the Add new rule button and specifying the values described above in "Step 2. Choosing feed fields to be used for matching".

  If you do not specify any new fields for a feed, the feed will contain them, but they will not be displayed in the Available fields subsection and will not be used in the matching process.

• For a STIX feed, in the Filtering rules for feeds section, click the feed name and, in the Available fields subsection, select any new field or fields that must be used by CyberTrace, and then click Save. Learn more about filtering rules.

Deleting a custom or third-party feed

To delete a custom or third-party feed:

1. In the Filtering rules for feeds section, select the tab that contains the feed you need to delete.

   You cannot delete the Internal TI supplier.

2. Click the name of the feed that you want to delete, and then click Delete.