Create an Indicator Type - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide
Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-18
Category
Administrator Guide
Abstract

In addition to the system-level indicator types, you can create custom indicator types in Cortex XSIAM.

When you create a custom indicator type, you configure fields and settings that impact how indicators of that type are enriched, how they are expired, how the verdict is calculated, etc.

Before you create a custom indicator type, you should familiarize yourself with the indicator type profile.

  1. SelectSettings → Configurations → Object Setup → Indicators → New.

  2. In the Attributes tab, add the required Indicator Type Profile parameters, such as name, regex, etc.

  3. In the Custom Fields tab, map the custom indicator fields, as required.