[KB8315] ESET Threat Intelligence with OpenCTI

Issue

• You need to utilize the OpenCTI TAXII2 ingester to ingest ESET Threat Intelligence feed data

Solution

1. In the OpenCTI dashboard main menu, choose: Data > Ingestion to open the Connectors section.

2. From the right panel choose TAXII Feeds.

3. Click the (+) icon on the right bottom of the screen.

   

   Figure 1-1

4. Create a TAXII ingester window will open.

5. Fill in the TAXII feed details:

   • Name: name of the feed f.e. ETI Botnet feed

   • TAXII server URL: URL of ESET Threat Intelligence TAXII 2.x API root f.e. https://taxii.eset.com/taxii2/643f4eb5-f8b7-46a3-a606-6d61d5ce223a

   • TAXII version: TAXII 2.1

   • TAXII Collextion: TAXII Collection ID f.e. 0abb06690b0b47e49cd7794396b76b20

   • Authentication type: Basic user/password

   • Fill in Username and Password, to get your credentials follow How to activate a TAXII feed

   • Import from date: choose at least yesterday

6. Click the CREATE button to create a new feed.