TISC MITRE Threat Intel Feeds - How to Enable?

[mgroversigital]

I have installed the Threat Intelligence Security Center app, and am working in the integrations view to get threat feeds from MITRE.  In the docs, it looks like you need the sn_sec_tisc.admin role, which I have granted myself.  From the docs, it also looks like once you have that role, you should be able to enable/edit the threat intel feeds.  However, all of the ones in the catalog are disabled and I don't have any kind of edit button to enable them:

Is there another requirement that I'm missing in the documentation somewhere?  This seems to be happening in my dev instance as well as a PDI, but when I had a lab instance through nowlearning, this wasn't an issue.

[venkatasrik]

Hey Did you got an answer for the above

[venkatasrik]

I logged in as Admin , And Opened TISC , I got the edit button right below the TISC open source feeds , I clicked on it and enabled it. Thanks

[mgroversigital · Accepted solution]

I did, actually.  It was somewhat silly, but not easy to troubleshoot.  After installing the application, I had changed scopes to work on something else.  When I came back to edit the integrations to enable, the edit button was hidden because the scope wasn't Threat Intelligence Support Common

[SN Arch Guy]

For Xanadu, I had to use the Threat Intelligence Security Center scope. But even though I've enabled the MITRE - Enterprise ATT&CK feed, when I look at a Security Incident observable in the Security Incident Response Workspace, and try to use the UI action Associate MITRE ATT&CK Technique, I am not shown any Source choices. See screen shot. Any thoughts why this might be? On my PDI I see the Mitre source just fine...