Duplicate threat intelligence feeds

Duplicating a threat feed allows you to create an exact copy of an existing feed, including all associated observables, indicators, actors, and so on.

Before you begin

Role required: sn_sec_tisc.admin

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Click on Integrations icon.
3. Select the desired integration from the Catalog view.
   For example, select CrowdStrike
4. Click Edit button for CrowdStrike feed card to open the configuration form.
5. Click the More Actions menu and select Duplicate.
   A confirmation is displayed indicating that the duplicated the current feed configuration and created a new feed with name [integrationname Feed-copy] with a link to the new duplicated feed. For example, CrowdStrike Feed-copy.