Skip to main content
Configure IBM QRadar to poll Reyhford STIX indicators via TAXII 2.1.

​
Prerequisites

  • QRadar 7.4+ with TAXII support
  • Reyhford API key
  • Network egress to api.reyhford.com

​
TAXII feed configuration

  1. Navigate to Admin → Threat Intelligence → TAXII Feeds.
  2. Click Add TAXII Feed.
  3. Configure:
ParameterValue
NameReyhford ICS/OT Feed
Server Addressapi.reyhford.com
Server Port443
Use SSLYes
Discovery Path/taxii2/
Collectionsreyhford-global-feed
Authentication TypeHTTP Header
HeaderAuthorization: Bearer <api-key>
Poll Interval3600 seconds
  1. Save and click Poll Now to test.

​
Indicator usage

QRadar maps STIX indicators to Reference Data and Offense rules. Recommended rules:
  • Match source IP against Reyhford-ICS-Indicators reference set
  • Elevate severity when confidence ≥ 70 and protocol is Modbus/S7/BACnet

​
Validate connectivity

curl -s https://api.reyhford.com/taxii2/collections/ \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1"