Connect Palo Alto Cortex XSIAM / XSOAR to AbuseIPDB threat intelligence

Cortex XSIAM and Cortex XSOAR are Palo Alto Networks' security operations and automation platforms. The TAXII 2 Feed integration pulls AbuseIPDB's crowdsourced IP threat indicators into Cortex as indicators. Not yet verified end to end against AbuseIPDB.

AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, such as brute-force logins, port scans, spam and web attacks. Its STIX/TAXII feeds deliver those addresses in STIX 2.1, the standard format threat intelligence tools exchange, over TAXII 2.1, the protocol those tools use to fetch it. Each address arrives as an indicator with its 0–100 confidence score, so you can check your logs against addresses other organizations have reported.

Already pull the AbuseIPDB blacklist through the API? Free and Paid feeds draw from that same blacklist, delivered straight into your SIEM or threat intelligence platform instead of to a script, and your check and blacklist integrations keep working as before. Your client signs in with your account email and one of your existing API keys. STIX/TAXII feeds are bought separately from your API plan and have their own daily indicator allowance; during the beta, accounts on a paid API plan can try one free feed first, with up to 10,000 indicators a day of addresses scoring at least 100. See Plans.

Not yet verified means AbuseIPDB hasn't tested this client end to end: the steps follow the vendor's documentation, so field names or screens in your version may differ. If a step doesn't match what you see, contact us.

Before you start: a feed on My TAXII Feeds using the IP threat indicators output format (you need its title), an API key, and Cortex XSOAR 5.5.0 or later or Cortex XSIAM.

1. Install the TAXII Feed content pack from the Marketplace, then add an instance of TAXII 2 Feed.
2. Configure the instance with these values:
   • Discovery Service URL: https://taxii.abuseipdb.com/taxii2/
   • Username / API Key: your AbuseIPDB account email, not the API key. Despite its label, this field is the username.
   • Password: any API key on your account.
   • API Root to Use: leave empty (the server advertises a default root), or enter abuseipdb-taxii2. This field takes the root name, not a URL.
   • Collection Name To Fetch Indicators From: the feed's title as shown on My TAXII Feeds, not its Collection ID. Give each feed a distinct title, because Cortex finds the feed by its title. Don't leave it empty: the integration would also poll the write-only AbuseIPDB reports collection, which returns 403.
   • Source Reliability: required; pick the rating your team assigns to AbuseIPDB as an intelligence source. It is separate from each address's AbuseIPDB confidence score and does not change your feed's minimum confidence.
   • First Fetch Time: lower the 1-year default to a few days: Enterprise feeds serve at most the last 60 days, and Free and Paid feeds ignore it.
3. Set Feed Fetch Interval (240 minutes by default) to 60 minutes on the Free and Paid plans, or your agreed interval on Enterprise (see recommended polling). Raise Max STIX Objects Per Poll from its default of 100 so a day of fetches covers your plan's daily indicator cap (see Plans): at 100 an hour Cortex takes at most 2,400 objects a day, and because Free and Paid feeds start again each UTC day from the addresses added to the blacklist earliest, a low limit brings the same addresses every day. Run taxii2-get-collections from the instance to confirm it can see your feed. After the first fetch, the feed's Last accessed date on My TAXII Feeds shows today; then confirm AbuseIPDB indicators appear in Cortex.

Output format

Use the IP threat indicators output format. Cortex creates an indicator from each pattern that names one value, and every AbuseIPDB indicator names one IP address. We expect Cortex to filter out the extra objects in the other output formats, but this has not been tested.

Multiple feeds

Each custom feed is its own collection; add one integration instance per feed.

The integration negotiates TAXII 2.1 first and only falls back to 2.0 if the server refuses.

If you hit issues, contact us.