DHS Feed v2

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) free Automated Indicator Sharing (AIS) capability enables the exchange of cyber threat indicators, at machine speed, to the Federal Government community.

Data Enrichment & Threat Intelligence · DHS Feed · Feed

Configuration parameters

  • feed — Fetch indicators
  • url — Discovery Service URL (e.g., https://ais2.cisa.dhs.gov/taxii2/) (required)
  • key — (required)
  • certificate — Certificate File as Text (required)
  • default_api_root — Default API Root to use
  • collection_to_fetch — Collection Name To Fetch Indicators From
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • initial_interval — First Fetch Time
  • objects_to_fetch — STIX Objects To Fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedBypassExclusionList — Bypass exclusion list
  • limit — Max Indicators Per Fetch
  • limit_per_request — Max STIX Objects Per Poll
  • observation_operator_mode — Complex Observation Mode
  • feedTags — Tags
  • feedIncremental — Incremental Feed

Commands (2)

  • dhs-get-collections

    Gets the list of collections from the discovery service.

  • dhs-get-indicators

    Allows you to test your feed and to make sure you can fetch indicators successfully. Due to API limitations, this command may take a long time to run. Make sure the 'execution-timeout' argument is increased. See the integration readme for further information.