Be able to take in STIX/TAXII data by automate-able means and map fields to such as MD5 to a MD5 field in sentinel. With the current feeds model, you typically import data to a single field type such as IP and then use a watch list in a correlation rule. By using the definitions you should be able to more intelligently import data.
by: cameron s. | over a year ago | Integrations
Comments
I think the other key item here is not just another event feed. But STIX/TAXII is the primary standard for interfacing the external threat services such as Webroot.
This has been accepted into our backlog for completion
Sentinel 8.1 was just released. One feature that was added was the ability to easily add threat reputation feeds into it. It is not specifically STIX/TAXII, but more open. There were many reasons that we did it this way, but this allows integration with many different types of feeds as well as being able to prioritize the information that the different feeds are providing, in the event of a conflict with another feed.