## ThreatMon Threat Feed

The ThreatMon Threat Feed integration allows Cortex to automatically pull Indicators of Compromise (IOCs) from the ThreatMon IOC platform and create them as indicators in Cortex.

### Get Your API Token

1. Log in to your ThreatMon account at [https://www.threatmon.io](https://www.threatmon.io).
2. Generate an API token for the IOC API.
3. If you do not have an account or an API token, contact the ThreatMon team at [integration@threatmonit.io](mailto:integration@threatmonit.io).

### Configuration Notes

- **Server URL** - The ThreatMon IOC API base URL. The default is `https://ioc.threatmonit.io`.
- **API Token** - Paste the token you generated into the password field. The username field is not used.
- **Data Type to Fetch** - Limits the fetch to a single IOC type (`ip`, `domain`, `url`) or fetches everything (`all`).
- **Collection IDs** - Optional. A comma-separated list of ThreatMon collection IDs, used to fetch only from specific collections (for example, C2 servers or phishing).
- **Maximum number of indicators per fetch** - Controls the page size requested from the API on each run.

This feed is incremental. Each run stores the newest indicator timestamp it has seen and skips indicators that were already ingested in previous runs.

---

**Support**

This integration is community supported. For questions about the ThreatMon platform or your API token, contact the ThreatMon team at [integration@threatmonit.io](mailto:integration@threatmonit.io).