Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

What is STIXX/TAXII?

STIX (Structured Threat Information Expression)

TAXII (Trusted Automated Exchange of Intelligence Information)

Feed Sources

Cabby library

Installing Cabby Library

AlienVault - Pulses and Feeds

Pulses

Feeds

Start Polling Collections

Polling From Own Profile

Polling From AlienVault Profiles

AlienVault Profile Collection Subscriptions

Adding Sources to ESA

Adding Source without Feeds

Polling Source without Feeds

Adding Source with Feeds

Polling Source with Feeds

Introduction

This document describes the steps to configure External Threat Feeds from an AlienVault source and can be used within ESA.

Prerequisites

Requirements

Cisco recommends knowledge of these topics:

- Cisco Secure Email Gateway (SEG / ESA).

- Linux CLI.

- Python pip.

- AlienVault account.

Components Used

The information in this document is based on these software and hardware versions:

- Email Security Appliance.

- Python3

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The External Threat Feeds (ETF) framework enables the email gateway to ingest external threat intelligence shared in STIX format via the TAXII protocol. By leveraging this capability, organizations can:

- Take a proactive stance against cyber threats such as malware, ransomware, phishing, and targeted attacks.

- Subscribe to both local and third-party threat intelligence sources.

- Enhance the overall effectiveness of the email gateway.

What is STIXX/TAXII?

STIX (Structured Threat Information Expression)

STIX is a standardized format used to describe cyber threat intelligence (CTI)—including indicators, tactics, techniques, malware, and threat actors—in a structured and machine-readable way. A STIX feed typically includes indicators—patterns that help detect suspicious or malicious cyber activity.

TAXII (Trusted Automated Exchange of Intelligence Information)

TAXII is a protocol used to exchange STIX data between systems securely and automatically. Defines how cyber threat intelligence is exchanged between systems, products, or organizations through dedicated services (TAXII servers).

Note: AsyncOS 16.0 release supports STIX/TAXII versions: STIX 1.1.1 and 1.2, with TAXII 1.1.

Feed Sources

Email Security Appliances can consume threat intelligence feeds from various sources, including public repositories, commercial providers, and their own private servers within your organization.

To ensure compatibility, all sources must use the STIX/TAXII standards, which enable structured, automated sharing of threat data.

Cabby library

The Cabby Python library is a useful tool for connecting to TAXII servers, discovering STIX collections, and polling threat data. It’s a great way to test and validate that a feed source is working correctly and returning data as expected before integrating it into your Email Security Appliance.

Installing Cabby Library

To install the Cabby library, you need to make sure that your local machine have Python pip installed.

Once python pip is install, you just need to run this command to install the cabby library.

python3 -m pip install cabby

Once cabby library installation is finished, you can verify that the taxii-collections and taxii-poll commands are now available.

(cabby) bash-3.2$ taxii-collections -h

usage: taxii-collections [-h] [--host HOST] [--port PORT] [--discovery DISCOVERY] [--path URI] [--https] [--verify VERIFY] [--timeout TIMEOUT] [--ca-cert CA_CERT]

[--cert CERT] [--key KEY] [--key-password KEY_PASSWORD] [--username USERNAME] [--password PASSWORD] [--jwt-auth JWT_AUTH_URL]

[--proxy-url PROXY_URL] [--proxy-type {http,https}] [--header HEADERS] [-v] [-x] [-t {1.0,1.1}]

(cabby) bash-3.2$ taxii-poll -h

usage: taxii-poll [-h] [--host HOST] [--port PORT] [--discovery DISCOVERY] [--path URI] [--https] [--verify VERIFY] [--timeout TIMEOUT] [--ca-cert CA_CERT] [--cert CERT]

[--key KEY] [--key-password KEY_PASSWORD] [--username USERNAME] [--password PASSWORD] [--jwt-auth JWT_AUTH_URL] [--proxy-url PROXY_URL]

[--proxy-type {http,https}] [--header HEADERS] [-v] [-x] [-t {1.0,1.1}] -c COLLECTION [--dest-dir DEST_DIR] [-l LIMIT] [-r] [--begin BEGIN] [--end END]

[-b BINDINGS] [-s SUBSCRIPTION_ID] [--count-only]

AlienVault - Pulses and Feeds

To start discovering AlienVault information, you need first create an account into AlienVault site and then start to search for the information you want.

In AlienVault, "feeds" and "pulses" are related but not the same:

Pulses

- A Pulse is a collection of threat indicators (IOCs) grouped around a specific threat or campaign.

- Created by the community or providers to describe things like malware, phishing, ransomware.

- Each pulse includes context like threat description, associated indicators (IP, domain, file hash, etc.), tags, and references.

- Pulses are human-readable and structured in a way that can be easily understood and shared.

Think of a pulse as a "threat report" with grouped IOCs and metadata.

Feeds

- Feeds are a stream of raw indicators (IOCs) pulled from one or more pulses, usually in an automated way.

- They are typically used by security tools to ingest indicators in bulk, via formats like STIX/TAXII, CSV, or JSON.

- Feeds are machine-focused and used for automation and integration with SIEMs, firewalls, and email gateways.

A feed is more about the delivery mechanism, while a pulse is the content and context of the threat.

Pulses = curated threat intel with grouped indicators + context (human-readable)

Feeds = automated stream of indicators from multiple pulses (machine-readable)

You usually poll feeds, and those feeds are made up of indicators extracted from pulses.

Start Polling Collections

Polling From Own Profile

Once you have your AlienVault account, you can start using the taxii-collections and taxii-poll commands.

In this case, I demonstrate how to use these commands.

In my case, within my AlienVault profile, there are no pulses available, but as a test, I am polling a collection from my profile using the taxii-poll command.

alienvault personal profile

taxii-poll --path https://otx.alienvault.com/taxii/poll --collection user_diegoher --username abcdefg --password anything

taxxi-poll user_diegoher

As you can see, there are no blocks polled because I do not have any information within my AlienVault profile.

Polling From AlienVault Profiles

Once profiles inside AlienVault are discovered, some of them have pulses. In this example, the AlienVault profile is used.

alienvault user profile

When running the poll with the taxii-poll command, it immediately starts fetching all the information from the profile.

taxii-poll --path https://otx.alienvault.com/taxii/poll --collection user_AlienVault --username abcdefg --password anything

taxxi-poll user_AlienVault

As shown, the process begins fetching the information.

Note: To know which is your username and password, check this link https://otx.alienvault.com/api

AlienVault Profile Collection Subscriptions

As a test, I subscribed to 3 profiles.

AlienVault profiles

You can use the taxii-collections command to fetch those subscriptions.

taxii-collections --path https://otx.alienvault.com/taxii/collections --username abcdefg --password anything

As you can see, the Collection Name is the same from the ones in where I am subcribed to. With this, you can confirm that the taxii-collections command is working and fetching without issues the source.

Adding Sources to ESA

Once you checked that the commands are working and are fetching information, you can proceed adding them to your Email Security Appliance.

The differences between adding an empty collection and a collection with feeds become evident.

Adding Source without Feeds

As observed in the Polling From Own Profil example, the source does not contain feeds. Next, the process of adding a source without feeds is explored.

1. Navigate to Mail Policies >External Threat Feeds Manager.

2. Change to Cluster Mode.

3. Click Add Source.

4. Hostname: otx.alienvault.com

5. Polling Path: /taxi/poll

6. Collection Name: user_<your_AlienVault_username>

7. Port: 443

8. Configure User Credentials: The one that AlienVault provided to you.

9. Click Submit > Commit Changes.

user_diegoher

Polling Source without Feeds

In the External Threat Feeds Manager, after the source is added, the newly added source becomes visible.

Polling from user_diegoher source

Once it was added, click Poll Now. After doing this, login to the ESA CLI and check the threatfeed logs to check the information.

0 observables fetched

As shown in the image you can see that 0 observables were fetched and this is expected because in my profile I do not have any feeds.

Adding Source with Feeds

Now, a collection that contains feeds is added. In this example, the AlienVault user profile is used as the source, which includes feeds. The outcome of adding a source with feeds is explored.

1. Navigate to Mail Policies >External Threat Feeds Manager.

2. Change to Cluster Mode.

3. Click Add Source.

4. Hostname: otx.alienvault.com

5. Polling Path: /taxi/poll

6. Collection Name: user_AlienVault

7. Port: 443

8. Configure User Credentials: The one that AlienVault provided to you.

9. Click Submit > Commit Changes.

user_AlienVault source

Polling Source with Feeds

In the External Threat Feeds Manager, after the source is added, the newly added source becomes visible.

Polling user_AlienVault feed

Once it was added, click Poll Now. After doing this, login to the ESA CLI and check the threatfeed logs to check the information.

user_AlienVault observables fetched

As shown in the image, you can see that several observables were fetched.

Note: If new feeds are added to the configured collection, the ESA automatically polls the source, and the new observables are fetched.