Indicator configuration

Customize your indicators to your specific needs. Edit existing indicator types and fields, add scripts, and configure tailored extraction and expiration settings for optimal insights.

Sub-topics

• Configure Threat Intelligence feed integrations
• Customize indicator fields and types
  • Create an indicator type
    • Indicator type profile
    • Formatting scripts
    • Enhancement scripts
    • Reputation scripts
    • Reputation commands
    • Map custom indicator fields
  • Create an indicator field
    • Indicator field structure
    • Indicator field trigger scripts
• Indicator classification and mapping
• Indicator extraction
  • Set the indicator extraction mode for a playbook task
  • Disable indicator extraction for scripts or integrations
• Configure Threat Intelligence feed integrations
• Exclude indicators from enrichment
• Generate issues from indicators using indicator rules for prevention and detection
• Export indicators