Think about ways to ingest SANS Top-100 Feed

[gtback]

https://misp.truesec.be/isc-top-100-stix.json

I'm not sure whether it's good to use/extend a DataSource for this, or just use requests to fetch and parse the content.

For more information, see this blog post

[mkultraWasHere]

FTR: Investigated issue, notes:

• Currently, this action can be completed with the current API, just requires some processing to be done on the user side (in variety of ways):
  1. requests ->json -> extract "source" (IP) field and custom fields ->| create Indicator()
  2. requests->json -> craft python dict ->| core.parse()
• This was already demonstrated for STIX 1.x (https://github.com/xme/toolbox/blob/master/isc2stix.py)
• Future: if we circle back to explicitly needing this functionality, abstract it out to 'retrieve_from_uri()' utility that is somewhere in DataStore suite.