Unit 42 ATOM feeds into XSIAM tenant without TIM license

[PA_nts]

Hi All,

Has anyone done this yet.. is it possible?

It looks like a simple process to enable taxii2 feed for unit 42 threat intel - but not sure what the outcome i can expect if a client has a XSIAM tenant but no TIM (threat intel management) license.

will it work and if so, what limitations would we have?

thanks

anton

[yonghong]

I believe you can still configure the Unit 42 ATOMs feed to collect indicators. However, you won't have access to the full indicator details, including the full view, which is a feature of the TIM license.