Indicator management - Perform actions (create, edit, export, delete) and search for indicators on the Cortex XSIAM Indicators page. - Threat Intel Management Guide - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Investigate an indicator

Click on an indicator to view and take action on the indicator.

Create an indicator

Indicators are added to the indicators table from feed integrations or you can manually create a new indicator in the system.

When creating an indicator, in the Verdict field, you can either select a Verdict or leave it blank to calculate it later by clicking Save & Enrich, which updates the indicator from enrichment sources. After you select an indicator type, you can add any custom field data.

Edit

Edit a single indicator or select multiple indicators to perform a bulk edit.

Delete and Exclude

Delete and exclude one or more indicators from all indicator types or a subset of indicator types.

If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted.

Export CSV

Export the selected indicators to a CSV file.

Export STIX

Export the selected indicators to a STIX file.

Upload a STIX file

To upload a STIX file, click the upload button (top right of the page) and add the indicators from the file to the system.

Rule ID

Unique identifier for the rule.

Creation Date

Timestamp of when the rule was created.

Modification Date

Timestamp when the rule was edited.

Name

Name of the rule.

Type

Whether the rule is a Prevention or Detection type rule.

Target

Hash, IP address, File, or domain value associated with the rule.

Severity

Level of severity associated with the rule.

# of issues

Number of issues generated by the rule.

Created by

The email address of the user who created the rule.

Description

An optional description associated with the rule.

Status

Whether the rule is Enabled or Disabled.

Used in profiles

Cortex XDR agent Restriction Profile associated with the rule.

View related issues

View issues generated by the rule.

Disable/Enable

Depending on the current status, Disable or Enable the rule.

Edit Rule

Modify the rule.

Save as new

Create a new rule using the current rule configurations.

Delete

Delete the rule.