Duplicate threat intelligence feeds

Duplicating a threat feed allows you to create an exact copy of an existing feed, including all associated observables, indicators, actors, and so on.

Before you begin

Role required: sn_sec_tisc.admin

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Select the Integrations icon.
3. Select the desired integration from the Catalog view.
   For example, select CrowdStrike
4. Select the Edit button for CrowdStrike feed card to open the configuration form.
5. Select the More Actions menu and select Duplicate.
   A confirmation appears indicating that the current feed configuration was duplicated. A new feed is created with the name [integrationname Feed-copy] and includes a link to the new duplicated feed. For example, CrowdStrike Feed-copy.