Configuring Inbound Intel Sharing Profiles
This section describes the inbound intelligence sharing profiles used to receive intelligence from external organizations into TISC.
Before you begin
Role required: sn_sec_tisc.admin
Note:
Procedure
Navigate to Workspaces > Threat Intelligence Security Center > Administration > Inbound Intel Sharing.
Select Inbound Intel Sharing Profiles.
Select New to create an Inbound Intelligence Profile.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Name | Name of the inbound intelligence profile. |
| Industry | Select the industry category such as Aerospace, Agriculture for which the inbound intelligence profile is applicable to. |
| Description | Description of the inbound intelligence profile. |
| Inbound Intelligence Settings | |
| Data Format | Supported data formats for inbound intelligence sharing profile.Currently, two data formats are supported for inbound intelligence sharing: - STIX 2.1 - MISP For more information on the data formats description, see Configuring Outbound Intel Sharing Profiles. |
| User for authentication \(should have sn\_sec\_tisc.api\_post\_intel role\) | Select the user whose credentials should be used for authentication when an external system shares intelligence with TISC for this profile.Note: Users with sn_sec_tisc.api_post_intel role only be available in the drop-down list. |
| Default Confidence | Indicates the default confidence level applied to all intelligence records received from this profile when the source doesn’t provide a confidence value. |
| Expiry period \(days\) | Specifies the number of days after which the intelligence records received from sharing profile expires.Once expired, the intelligence records might no longer be visible, shared, or considered valid. |
| Default TLP | Specifies the default TLP applied to all intelligence records received from this profile when the source doesn’t provide a TLP value. |
| Enable Notification | Select this check to send a notification to the sender on approval or rejection of the inbound intelligence record. |
| Notify On | Use this option to choose when to notify the email recipients configured (for example, on approval or rejection or both of a record).Note: This option appears only if Enable Notification is selected. |
| Email Recipients | Enter the email addresses of users who should be notified based on the criteria configured in the Notify On field.Note: This field is only visible when Enable Notification is checked. Multiple email addresses can be entered, separated by commas. |
| TISC Tags | Specifies the tags to be added to all the inbound intelligence received from external system. |
Select Save.
Copy Profile ID:
The external organizations require this profile ID to share the information.
Select Copy Profile ID button to copy your profile ID for sharing.
Additionally, select Email Profile ID to email the sharing profile details.
When you select this option, an email composer dialog box is displayed. Fill the email details to whom you want to share the profile.
Select Send to send the details to the external user.
Parent Topic:Exploring Inbound Intel Sharing
Related topics
Configuring Inbound Intel Sharing Groups
Defining Approval Rule for Inbound Intel