---
title: "Creating an HTTP Feed | ThreatConnect"
slug: "creating-an-http-feed"
description: "This article describes how to create an HTTP feed for sources of information in ThreatConnect."
tags: ["Administrator", "Importing Data"]
updated: 2024-04-12T14:12:38Z
published: 2024-04-12T14:12:38Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating an HTTP Feed

## Overview

Organization Administrators can set up an ad hoc HTTP Feed (also known as a “screen scrape”) for sources of information in ThreatConnect®. This ability is particularly useful when a more in-depth feed integration with ThreatConnect does not exist. In order for this feature to work adequately, the source of information should be updated with some regularity. When the Feed Monitor finds Indicators at the designated URL, it will import the Indicators according to the configuration.

## Before You Start

| Minimum Role(s) | Organization role of Organization Administrator |
| --- | --- |
| Prerequisites | A Source administered by the Organization |

## Creating an HTTP Feed

1. Log into ThreatConnect with an account that has access to the desired Source.
2. On the top navigation bar, click **Posts**. The [**Posts** screen](https://knowledge.threatconnect.com/docs/posts) will be displayed.
3. Select a Source using the selector at the upper-right corner of the screen or from the **Intelligence Sources** section of the **My ThreatConnect**card on the left side of the screen. The **Posts**screen for the selected Source will be displayed (Figure 1).

![Graphical user interface, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/creating-an-http-feed-image-dl2wt8m5.png)
4. Click **Source Config** ![Icon  Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/creating-an-http-feed-image-dcruua8j.png) icon at the upper-right corner of the **Source**card. The **Attribute Types**tab of the **Source Config** screen will be displayed.
5. Click the **Data** tab. The **Data**screen will be displayed (Figure 2).

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/creating-an-http-feed-image-ka5o5x4t.png)
6. Click the **+ NEW**button in the **HTTP Feeds**section. The **Create Source Feed**window will be displayed (Figure 3).

![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/creating-an-http-feed-image-vgid4a2q.png)
  - **Name**: Enter a name for the Source Feed.
  - **URL**: Enter the URL to monitor for Indicators.
  - **Exclude Indicators**: Enter Indicators to be excluded from ingestion by the Source Feed, separated by commas. For instance, **threatconnect.com** may be present on a web page, but not desired for import.
  - **Tags (comma separated)**: Enter [Tags](https://knowledge.threatconnect.com/docs/applying-tags) to associate with all Indicators imported by the Source Feed, separated by commas.
  - **Description**: Enter a general description to be added to the [Description Attribute](https://knowledge.threatconnect.com/docs/the-description-attribute) on Indicators imported by the Source Feed.
  - **Source**: Enter a Source description to be added to the [Source Attribute](https://knowledge.threatconnect.com/docs/sourcing-data) on Indicators imported by the Source Feed.
  - **Use this feed for Deletion**: Select this checkbox if the Source Feed should use its input to delete Indicators. Otherwise, leave the checkbox cleared to specify that the Source Feed should use its input to create Indicators.
  - **Choose Import Options**: Select the Indicator type(s) for which the Source Feed should search.
  - **Default Threat Rating**: Use the skull icons to set the default [Threat Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for Indicators imported by the Source Feed.
  - **Default Confidence Rating**: Use the slider to set the default [Confidence Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for Indicators imported by the Source Feed.
  - **Next Execution Time**: Enter the next date and time when the Source Feed will run.
  - **Collection Interval (hours)**: Enter the interval, in hours, at which the feed should collect data.
  - **Beginning Buffer**: Enter the number of lines at the top of the web page at the URL to exclude from Indicator parsing.
  - **Ending Buffer**: Enter the number of lines at the bottom of the web page at the URL to exclude from Indicator parsing.
  - Click the **SAVE** button. The new feed will be displayed in the **HTTP Feeds**section of the **Data**screen.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20072-01 v.01.F

## Related

- [Structured Indicator Import](/structured-indicator-import.md)
- [Unstructured Indicator Import](/unstructured-indicator-import.md)
- [Using Automated Email Ingest](/using-automated-email-ingest.md)