How to download threat feeds directly from Alliance

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Provide a command to download threat feeds using alliance client certs.

Environment

• EDR Server: All Versions

Resolution

Execute the following command:

for feed in abusech Bit9AdvancedThreats alienvault CbCommunity Bit9EarlyAccess Bit9SuspiciousIndicators Bit9EndpointVisibility fbthreatexchange CbKnownIOCs sans mdl ThreatConnect tor attackframework; do curl --cert /etc/cb/certs/carbonblack-alliance-client.crt --key /etc/cb/certs/carbonblack-alliance-client.key https://threatintel.bit9.com/api/v1/cbfeed/feed/$feed > $feed.json; done

Additional Information

• This command can be ran on any host that has the alliance client certs on it in the specified location. An EDR Server is NOT required.