Duplicate threat intelligence feeds

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Duplicate a threat feed to create an exact copy with all associated observables, indicators, and actors when you want to modify settings without affecting the original feed.

    Before you begin

    Role required: sn_sec_tisc.admin

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select the Integrations icon.
    3. Select the desired integration from the Catalog view.
      For example, select CrowdStrike
    4. Select the Edit button for CrowdStrike feed card to open the configuration form.
    5. Make the necessary changes, as required.
    6. Select the More Actions menu and select Duplicate.
      A confirmation appears indicating that the current feed configuration was duplicated and a new feed was created with the name [integrationname Feed-copy]. For example, CrowdStrike Feed-copy.