Customize indicator fields and types - Administrator Guide - Threat Intel Management Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM provides out-of-the-box indicator types and fields. However, your use case may require indicator customization, either by editing existing indicator types and fields or by creating new ones to help investigate and respond to potential security threats specific to your organization.

Custom indicators can provide more accurate and efficient identification of potential cyber security threats. For example, you can customize indicators to monitor and detect unusual activity within your organization's internal network. This can include creating indicators to flag unauthorized access attempts or unusual data transfers, or identifying insider threats or compromised accounts.

Before customizing an indicator, review the ingested indicator and then customize it as needed. After ingesting alerts and indicators, check the indicator information associated with your alert. From an alert, review the context data. If there is information in the context data that you don't see in the indicator, map it into indicator fields and display it in the layout.

You can customize the following: