Perform actions (create, edit, export, delete) and search for indicators on the Cortex XSIAM XSIAM Indicators page.
Indicators are artifacts associated with security incidents and are an essential part of the incident management and remediation process. They help correlate incidents, create hunting operations, and enable you to easily analyze incidents and reduce Mean Time to Response (MTTR).
Cortex XSIAM threat intelligence includes access to the Unit 42 Intel service, enabling you to identify threats in your network and discover and contextualize trends. Unit 42 Intel provides data from WildFire (Palo Alto Networks’ cloud-based malware sandbox), the PAN-DB URL Filtering database, Palo Alto Networks’ Unit 42 threat intelligence team, and third-party feeds (including both closed and open-source intelligence). Unit 42 Intel data is continually updated to include the most recent threat samples analyzed by Palo Alto Networks, enabling you to keep up with threat trends and take a proactive approach to securing your network.
Under the Detection & Threat Intel side menu, Threat Intel Management contains the following sub menu items:
Indicators
Sample Analysis
Sessions and Submissions
Indicator Rules
Indicators
Displays a list of indicators added to Cortex XSIAM, where you can perform several indicator actions, including Unit 42 data. Search and look up indicators. For understanding search queries, see Query indicators with Unit 42 Intel data.
You can perform the following actions on the XSIAM Indicators page.
Action | Description |
|---|---|
Investigate an indicator | Click on an indicator to view and take action on the indicator. |
Create an indicator | Indicators are added to the Indicators table from feed integrations, adding Unit 42 data, or you can manually create a new indicator in the system. When creating an indicator, in the Verdict field, you can either select a Verdict or leave it blank to calculate it later by clicking Save & Enrich, which updates the indicator from enrichment sources. After you select an indicator type, you can add any custom field data. |
Edit | Edit a single indicator or select multiple indicators to perform a bulk edit. |
Delete and Exclude | Delete and exclude one or more indicators from all indicator types or a subset of indicator types. If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted. |
Export CSV | Export the selected indicators to a CSV file. |
Export STIX | Export the selected indicators to a STIX file. |
Upload a STIX file | To upload a STIX file, click the upload button (top right of the page) and add the indicators from the file to the system. |
Sample analysis
Unit 42 Intel also provides sample analysis for files that help you conduct in-depth investigations, find links between attacks, and analyze threat patterns. If the file indicator is in the Unit 42 Intel service, you have access to a full report on activities, properties, and behaviors associated with the file. In addition, you can see how many other malicious, suspicious, or unknown file samples included the same activities, properties, and behaviors, and also build queries to find related samples. For more information, see Investigate files using sample analysis.
Sessions and Submissions
Unit 42 Intel provides in-depth information on device communication.
Cortex XSIAM users can use their Sessions and submissions data for investigation and analysis. You can see which XDR agent reported the file and which computers are affected.
For example, if you have a file indicator that has been determined as malicious, in the Sessions & Submissions tab, you can see where this file came from and where it is in your network by viewing the firewall sessions this file passed through. You can see which XDR agents in your system reported the file, which tells you which machines might be infected. You can block the external IP address with your firewall, and, if needed, isolate the affected machines to contain the attack. If the source is internal, you can investigate that endpoint.
Indicator Rules
The Indicator Rules page displays the following fields for each rule. For more information, see Generate alerts from indicators using indicator rules for prevention and detection.
Field | Description |
|---|---|
Rule ID | Unique identifier for the rule. |
Creation Date | Timestamp of when the rule was created. |
Modification Date | Timestamp when the rule was edited. |
Name | Name of the rule. |
Type | Whether the rule is a Prevention or Detection type rule. |
Target | Hash, IP address, File, or domain value associated with the rule. |
Severity | Level of severity associated with the rule. |
# of alerts | Number of alerts generated by the rule. |
Created by | Email address of the user who created the rule. |
Description | Optional description associated with the rule. |
Status | Whether the rule is Enabled or Disabled. |
Used in profiles | Cortex XDR agent Restriction Profile associated with the rule. |
Note
if an indicator matches multiple indicator rules, the highest severity rule is used. If all have the same severity, the rules are used by first created.
In the Indicator Rules table, right-click a rule to perform actions, including the following:
Action | Description |
|---|---|
View related alerts | View alerts generated by the rule. |
Disable/Enable | Depending on the current status, Disable or Enable the rule. |
Edit Rule | Modify the rule. |
Save as new | Create a new rule using the current rule configurations. |
Delete | Delete the rule. |