Create incident manually, from an integration feed, or by adding Unit 42 data.
Indicators can be created manually, from an integration feed, or by adding Unit 42 data.
Create an indicator manually.
Add the Basic information.
In the Verdict section you can either select a verdict, or leave it unset in order to calculate it later by clicking Save & Enrich for the indicator.
Add any custom indicator fields.
Save the indicator, or use Save & Enrich to update the indicator from enrichment sources.
Fetch indicators from Feed Integrations.
(TIM only) Add Unit 42 Intel Data to Cortex XSOAR.