FAQ

Is this feature free?

This feature is free for registered users; who contribute data to Abusix Intelligence services; however, you must have an Abuse HQ Instance to have the data parsed and attributed for use within your network security operations.

Why does Abusix prefer the API for data provided by our customer’s web forms and internal systems?

While the XARF format may be used in SMTP, RESTful API, UDP, and other transport methods, we recommend using the RESTful API as the transport for web forms and internal systems because it is easy and fast to self configure and since it will provide you with instant feedback on whether or not the data has been accepted at the endpoint and if it is correctly formatted and thus parsed accurately.

How do the reports get forwarded to the correct destinations?

We use an elaborate system of parsers that clean and extract all relevant data that reaches us via the Data Channels. Data that successfully pass this step will be forwarded to the necessary destinations. This might happen based on the type of Data Channel you create or the reported IP-address/URL.

How can I change my SMTP - Data Channel's datatype?

Currently, we don't offer modification of datatypes after creation. We do this to ensure that the Data Channels will always send in only one datatype and will be parsed accordingly. You can, however, freely create as many additional Data Channels for all the datatypes you'd like to send us.

What happens if data doesn't get parsed correctly?

Data that cannot be parsed correctly can not be used for our systems and will not be used to enrich your Abuse HQ instance or our systems (if you choose for the data to be shared within our systems).

Why can't I delete my Data Channel?

Certain types of Data Channels are blocked by Abusix from being deleted and thus don't have a remove button. The reasons for this are consistency and stability since our side sometimes will depend on your side's setup.

If you, however, would still like them to be deleted, please get in touch with our support team.

Does Abusix send data to the affected network owners?

As of now, only network owners using an AbuseHQ instance will be notified. For other external parties, this is a feature in planning/development. As soon as it's released, any affected network owners will be notified about the reports. Also, this will only happen if the consent to do so was granted while creating the Data Channel.

Learn more about Data Channels

This will help provide you with an Overview of the XARF Format