Indicator management - Perform actions (create, edit, export, delete) and search for indicators on the Cortex XSOAR Threat Intel page. - Threat Intel Management Guide - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Investigate an indicator

Click on an indicator to view and take action on the indicator.

Create an indicator

Indicators are added to the Indicators table from incoming incidents, feed integrations, or manually creating a new indicator.

When creating an indicator, in the Verdict field, you can either select a verdict or leave it blank to calculate it by clicking Save & Enrich, which updates the indicator from enrichment sources. After you select an indicator type, you can add any custom field data.

Create an incident

Create an incident from the selected indicator and populate relevant incident fields with indicator data.

Edit

Edit a single indicator or select multiple indicators to perform a bulk edit.

Delete and Exclude

Delete and exclude one or more indicators from all indicator types or a subset of indicator types.

If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted.

Export CSV

Export the selected indicators to a CSV file. By default, the CSV file is generated in UTF8 format. Administrator permission is required to update server configurations, including changing the format, see Export incidents and indicators to CSV using the UTF8-BOM format.

Export STIX

Export the selected indicators to a STIX file.

Upload a STIX file

To upload a STIX file, click the upload button (top right of the page) and add the indicators from the file.