# Threat Intel module

**URL:** <https://discuss.elastic.co/t/threat-intel-module/269679>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 9, 2021, 8:20am UTC](https://discuss.elastic.co/t/threat-intel-module/269679 "2021-04-09T08:20:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbathla](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@sbathla](https://discuss.elastic.co/u/sbathla)\
**Post date:** [April 9, 2021, 8:20am UTC](https://discuss.elastic.co/t/threat-intel-module/269679/1 "2021-04-09T08:20:18Z")

</div>

Hi all,

Need one help. I tried to integrate threat intel module in 7.12 version. Post integration I am able to view dashboard for Abuse URL and Abuse malware but not getting results for MISP, Otx, alienvault..Did the required configurations also..Can someone please help

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 13, 2021, 11:11pm UTC](https://discuss.elastic.co/t/threat-intel-module/269679/2 "2021-04-13T23:11:55Z")

</div>

Hello @sbathla 🙂

Did you manage to resolve this? Just wanted to check if its only the dashboard that is not working, do you have any data from those sources if you look in the discover page?

---

<div class="post-metadata">

**Author:** ![variable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/variable/32/118277_2.png) [@variable](https://discuss.elastic.co/u/variable)\
**Post date:** [April 19, 2021, 5:15pm UTC](https://discuss.elastic.co/t/threat-intel-module/269679/3 "2021-04-19T17:15:39Z")

</div>

Hello @sbathla.

We're glad that you're giving the module a try.

I think I might know what your issue with the MISP, OTX, and Anomli feeds is.

**MISP**  
You need to have your own MISP server. MISP is a third-party, open-source, platform. You can check them out here [https://www.misp-project.org/](https://www.misp-project.org/). Once you have MISP set up, you can simply update the `threatintel.yml` to include your server location and API key.

> **[Threat Intel module | Filebeat Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-threatintel.html#_misp_fileset_settings)**

**OTX**  
AlienVault Open Threat eXchange (OTX) is a cloud threat feed provided by the AlienVault team. Unlike Abuse Malware and Abuse URL, this requires an API key that you can get simply by signing up for the service over at [https://otx.alienvault.com](https://otx.alienvault.com). Once you have your API key, you can enter it in `threatintel.yml`.

> **[Threat Intel module | Filebeat Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-threatintel.html#_otx_fileset_settings)**

**Anomali**  
There isn't anything that you need to sign up for with Anomali, but their API credentials are commented out by default. You can simply go into `threatintel.yml` and remove the `#` before `var.username: guest` and `var.password: guest`.

Of note, Anomali also has multiple feeds that you can subscribe to. We provided a default one, but there other others with various amounts of indicators.

To get those feeds, you can query Limo to get the feed IDs with:

```auto
curl -u guest:guest https://limo.anomali.com/api/v1/taxii2/feeds/collections/ | jq

{
  "collections": [
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "107",
      "title": "Phish Tank"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "135",
      "title": "Abuse.ch Ransomware IPs"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "136",
      "title": "Abuse.ch Ransomware Domains"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "150",
      "title": "DShield Scanning IPs"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "200",
      "title": "Malware Domain List - Hotlist"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "209",
      "title": "Blutmagie TOR Nodes"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "31",
      "title": "Emerging Threats C&C Server"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "313",
      "title": "DT COVID-19"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "33",
      "title": "Lehigh Malwaredomains"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "41",
      "title": "CyberCrime"
    },
    {
      "can_read": true,
      "can_write": false,
      "description": "",
      "id": "68",
      "title": "Emerging Threats - Compromised"
    }
  ]
}

```

Taking the ID number, you can update the URL ID to target different feeds.

Example

```auto
var.url: https://limo.anomali.com/api/v1/taxii2/feeds/collections/135/objects?match[type]=indicator

```

Of note, only 1 `var.url` can be used at a time.

> **[Threat Intel module | Filebeat Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-threatintel.html#_anomali_fileset_settings)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2021, 7:15pm UTC](https://discuss.elastic.co/t/threat-intel-module/269679/4 "2021-05-17T19:15:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.