Integrate third-party threat intelligence into your IVX Cloud analysis workflow to block malicious files and URLs across enterprise applications. This enables real-time validation by querying external feeds in parallel with internal Threat Intelligence to increase detection accuracy. This streamlined approach provides comprehensive coverage without the need to maintain or store local intelligence libraries.
Add a third-party intelligence engine
Log in to the IVX Cloud portal and go to Settings → Integrate Your Intelligence.
Click Add to open the Add New Intel Engine configuration modal.
Enter the General Settings details:
Engine Name: Provide a unique identifier for this configuration.
API Endpoint: Enter the base URL of the external service (excluding the protocol).
Timeout: Specify the maximum time in seconds to wait for a response (Default is 60s).
Configure Response Parsing to map external data to IVX Cloud:
Verdict Key: Enter the JSON key path containing the detection status, for example,
data.attributes.status.Verdict Value: Specify the exact value that indicates a malicious result, for example, MALICIOUS.
Signature Key: Enter the JSON key path for the threat name or signature identifier.
Select the Authorization method required by your external API.
Define Object & Scan settings:
Object type: Select Files to scan uploaded samples or Urls to scan web links.
SSL settings: Toggle SSL Enable and SSL Verify based on your security requirements.
(Optional) Enter Extra Query Parameters or Extra Headers as valid JSON strings, for example, {"key": "value"}.
Click Save.
Manage intelligence engines
Once added, you can manage your engines from the Integrate Your Intelligence page:
Enable/Disable: Use the toggle buttons to temporarily stop or start external queries.
Health Status: Monitor the Health column to ensure the connection to the external API remains active.
Edit/Remove: Update existing configurations or delete engines that are no longer required.