Manually Share Indicators - EoL - Multi-Tenant Guide - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide

Cortex XSOAR
Creation date
Last date published
End of Life > EoL
Multi-Tenant Guide

Share indicators manually by sending one or more indicators from a tenant to a dedicated shard Elasticsearch index.

While in most cases, the Cortex XSOAR Indicators Share integration is used to share indicators, indicators can also be shared manually. You might want to do this to share a few indicators or to share indicators that would not be returned using the indicator query you have set in the Cortex XSOAR Indicators Share instance.

You can manually share one or more indicators from the Threat Intel (Indicators) page. When you share an indicator, the indicator is stored in a dedicated shared index in Elasticsearch, and can be fetched by other tenants, using the Elasticsearch Feed integration.

  1. Go to the Threat Intel (Indicators) page and search for the indicator(s) you want to share.

  2. Select the indicator(s) and Share the indicator(s).