Threat Intelligence - only able to get one Anomali Limo collection pull

Copper Contributor

Morning everyone - new to the forum in terms of posting but always lurking on the posts :)

 

Looking to get any help/suggestions/ideas that you can offer. I currently am in the process of ingesting some TI via TAXII server(s) into Sentinel. Currently I can get data in from the Anomali Limo server via collection ID 150 and a IBM X-Force collection for phishing URLs. The issue is I can only get one Limo collection in - I've set up the different collection IDs as shown in a handful of guides and copied as they have (ensuring it makes sense logically and technically to myself; not just doing it willy-nilly) and to no avail It just doesn't pull. It could be an issue on their side, so I'll try and contact them to make sure I've done it correctly and they have no reported issues. Not sure what I could be missing - TI platform connector is enabled and works (as I can get the one Limo and IBM collection in) and my OTX Logic App works fine too. 

 

Any help would be greatly appreciated - many thanks.

0 Replies