Set up cyber threat feed for domain

To enable a domain feed, you must have two watchlists to hold IP addresses and domain data.

From the Trellix ESM dashboard, click and select System Properties.
Click Cyber Threat Feeds → Add to create a feed.
The Cyber Threat Feed Wizard opens.
On the Main tab, enter the Name.
On the Source tab, enter the connection fields.
On the Watchlist tab, click Create New Watchlist.
Enter Name as CyberThreatIP and click Next.
Select IP Address for Type and click Finish.
To add second watchlist, click Create New Watchlist.
Enter Name as CyberThreatDomain and click Next.
Select Web_Domain for Type and click Finish.
Select IPv4 for the Indicator Type and CyberThreatIP for the Watchlist.
In the next Indicator Type field, select Fully Qualified Domain Name and CyberThreatDomain for the Watchlist.
On the Backtrace tab, enter the cyber threat feed setup, and click Finish.