Manually Share Indicators - Multi-Tenant Guide - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide

Product
Cortex XSOAR
Version
6.11
Creation date
2022-12-12
Last date published
2023-12-18
Category
Multi-Tenant Guide

While in most cases, the Cortex XSOAR Indicators Share integration is used to share indicators, indicators can also be shared manually. You might want to do this to share a few indicators or to share indicators that would not be returned using the indicator query you have set in the Cortex XSOAR Indicators Share instance.

You can manually share one or more indicators from the Threat Intel (Indicators) page. When you share an indicator, the indicator is stored in a dedicated shared index in Elasticsearch, and can be fetched by other tenants, using the Elasticsearch Feed integration.

  1. Go to the Threat Intel (Indicators) page and search for the indicator(s) you want to share.

  2. Select the indicator(s) and Share the indicator(s).

    manual-share-indicators.png