Creating a Feed for the Carbon Black Cloud Threat Intelligence Connector

This topic describes how to create a feed for the Carbon Black Cloud Threat Intelligence Connector.

Example:

Usage: cbc-threat-intel create-feed [OPTIONS] [FEED_NAME] [PROVIDER_URL]
                                    [SUMMARY]

  Creates a feed in CBC

  Example usage:

      cbc-threat-intel create-feed STIXFeed http://test.test/ empty

      cbc-threat-intel create-feed STIXFeed http://test.test/ empty -ca STIX
      -c default -q

Arguments:
  [FEED_NAME]     The name for the feed that is going to be created
  [PROVIDER_URL]  The URL of the provider of the content
  [SUMMARY]       Summary of the feed

Options:
  -ca, --category TEXT    The category that the feed will have  [default:
                          STIX]
  -c, --cbc-profile TEXT  The CBC Profile set in the CBC Credentials
                          [default: default]
  -q, --quiet             This will only print the id of the created feed
  --help                  Show this message and exit.

Based on the preceding example, you must be aware of the following parameters before you create the feed.

Option or Argument	Default	Description
FEED_NAME	String, Required	The name for the feed to be created
PROVIDER_URL	String (URL), Required	The URL of the provider of the content
SUMMARY	String, Required	The summary of the feed
--category (-ca)	String (“STIX”)	The category of the feed
--cbc-profile (-c)	String (“default”)	The Carbon Black Cloud Profile set in the Carbon Black Cloud Credentials
--quiet (-q)	Boolean (False)	Only prints the ID of the created feed

In some cases, you can use -q to pipe this command with the create-watchlist and automatically create feeds that are subscribed from a newly created watchlist.