Anomali STAXX and Hail a Taxii

Today we are going to add a new feed to our Anomali Threat Server.  Called Hail a Taxii

Anomali makes this process extremely easy. Login to your Anomali STAXX server

Then click the setting tab in the upper right corner.

This will bring you to the site where you can add your new Feed. As you can see I already have 3 feeds added - the default Limo, Alien Vault OTX, and IBM X-Force.

Click on Add Site in the upper right. The Add New Site Window is launched.

For the Description I've added "Hail A TAXII" and the Discovery location is simply the poll location for Hail A TAXII   "http://hailataxii.com/taxii-discovery-service"  Username: guest  Password: *****
Click on Add Site / Discover (depending on the version you're running)


Once the Discover process is complete your left with several new Feeds to add to your arsenal

I've enabled all the above Feeds and ran a quick Poll. As you can see below we have started to collect Intel "data" from various locations.

Let's head back to our Dashboard. As you can see we are already seeing some Source data coming in.

Let's drill down into an example - in this case, Phish_URL Data. You can do so by simply clicking on the corresponding color in the graph. Below you can see several new phishing links.

I then clicked on one of the sites at random htxxp://ether-*****.us  this gives us a quick glance at more information on this site.  ( Note this launches to Anomali free cloud-based solution https://staxx.anomali.com/detail/domain )

So far I am really liking what Hail a TAXII is bringing to the table as far as feeds go and you cannot beat the price!