Define an Indicator
Define an Indicator.
Before you begin
Role required: sn_sec_tisc.analyst
Procedure
Navigate to Workspaces > Threat Intelligence Security Center > Threat Intel Library > Indicators.
Select Indicator.
Click New.
Note: Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record.
On the form, fill in the fields.
| Field | Description |
|---|---|
| ID | Unique ID of the indicator. |
| Description | Description of the indicator. |
| Name | Name of the indicator. |
| Pattern | The detection pattern for this Indicator may be expressed as a STIX Pattern. |
| Pattern Type | The pattern language used in this indicator. |
| Pattern Version | The version of the pattern language that is used for the data in the pattern property which must match the type of pattern data included in the pattern property. |
| Valid From | The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents. |
| Valid Until | The time after which this Indicator should no longer be considered a valid indicator of the behaviors it is related to or represents. |
| IOC Classification | The IOC classification of the indicators. |
| Indicator Types | Indicates the various categories of the indicator. |
| Status | Indicates the status of the indicators. |
| Platforms | Defines the platforms for which this indicator is applicable for. |
| TLP | Unique value that indicates the Data sensitivity setting per TLP. |
| Attack Phases | Represents attack phase in a kill chain such as LM, MITRE ATT&CK. |
| Confidence | Enter the confidence for this indicator record.The confidence property identifies the confidence that the creator has in the correctness of their data. The confidence value MUST be a number in the range of 0-100. |
| Threat Level | Indicates the threat level of the indicator record. |
| Expiration Time | Specifies the expiration time of the indicator record. |
| Threat Severity | Indicates the threat severity of the indicator record. |
| Usage Categories | Categories that the observable falls under, such as botnet or phishing. |
| First Seen | The time that this indicator record was first seen performing malicious activities. |
| Last Seen | The time that this indicator record was last seen performing malicious activities. |
| Source | Specifies the threat source from which this record is created. |
| Revoked | Indicates that the revoked objects are no longer considered valid by the object creator. |
|Field|Description|
|-----|-----------|
|Notes|Add any additional notes for an indicator.|
| Field | Description |
|---|---|
| Additional Context | Add any additional context for this indicator. |
| Spec Version | The version of the STIX specification used to represent the indicator.The value of this property must be 2.1 for STIX Objects defined according to this specification. |
| Lang | This property identifies the language of the text content in this object. |
| Created | Specifies the time when the indicator is created in system. |
| Updated | Specifies the time when the indicator is updated in system. |
| Extensions | Indicates the extensions of indicator. |
| Processing Status | Represents the processing status of this indicator. |
Click Save.
After you save, a prompt message is displayed indicating that A new observable record is created. Click Continue to edit the record and create new relationships.
Click Continue.
Important: After you create a new observable record, Prevent System Updates check box is displayed.
Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created.
Field Description Tags Select Tags Select the tags that are associated with an indicator. Add Tags Add new tags. Taxonomies Select Taxonomy Select the Taxonomy that is associated with an indicator. Add Taxonomy Values Add the Taxonomy values that are associated with an indicator. Field Description The source records details for an indicator are displayed, if any.
What to do next
You can now click any of the following related lists to view additional information about objects associated with the indicators.
| Related List | Description |
|---|---|
| MITRE Techniques | Lists the MITRE techniques related to this indicator. |
| Attack Patterns | Lists the Attack Patterns source that describe the methods that adversaries attempt to compromise targets that are related to this indicator. |
| Campaigns | Lists the Campaigns Source that describe a set of malicious activities or attacks that occur over time against a specific set of targets that are related to this indicator. |
| Courses of Action | Lists the courses of action related to this indicator. |
| Data Sources | Lists the data sources related to this indicator. |
| Data Components | Lists the data components related to this indicator. |
| Identities | Lists the identities that are related to this indicator. |
| Indicators | Lists the indicators that are related to this indicator.Note: This section also contains the potential relationships between two indicators. For more information, see Confirm indicator-indicator potential relationshipsand see Define indicator-indicator relationships for the confirmed relationships between the two observables. |
| Infrastructure | Lists the Infrastructure Source that describe any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack that are related to this indicator. |
| Intrusion Sets | Lists a set of adversarial behaviors and resources with common properties that are related to this indicator. |
| Locations | Lists the geographical locations associated with the object. |
| Malware | Lists malware source records that are related to this indicator. |
| Marking Definitions | Lists the marking definitions associated with this object. |
| Malware Analysis | Lists the metadata and results of a particular static or dynamic analysis performed on a malware instance associated to this indicator. |
| Observables | Lists the related observable records that are related to this indicator. |
| Observed Data | Lists the observed data that are cyber security related entities such as files, systems, and networks and associated with this indicator. |
| Sightings | Lists sightings source records associated with this object. |
| Threat Actors | Lists changes associated with the observable. |
| Threat Events | Lists the event or situation that has the potential for causing undesirable consequences or impact that are associated with the indicator. |
| Threat Groupings | Lists the threat groupings as objects that have a shared context. |
| Threat Notes | Lists the threat notes that convey information to provide further context or analysis that are associated with the indicator. |
| Threat Opinions | Lists the threat opinions as an assessment of the accuracy of the information that are associated with the indicator. |
| Threat Reports | Lists the threat reports associated with this indicator. |
| Tools | Lists the tool associated with this object. |
| Vulnerabilities | If the observable is an IP address, this list shows any resources \(configuration items\) that have a matching IP address. |
| Related Cases | Lists the related cases that are associated with this indicator. |
| Related Case Tasks | Lists the related case tasks that are associated with this indicator. |
| Related Canvases | Lists the related canvases that are associated with this indicator. |
| Indicators References | List of external references that describes this indicator. |
Note:
- You can link and unlink the related records associated with this object. For more information, see Link Threat Intel Related Records.
- Also, from the Related Records section, you can confirm the relationships between two Observables using the Potential Relationships section available on the Indicators form view. For more information on see, Confirm Potential Relationships from Related Records.
- You can add indicators to cases. For more information, see Add to Case.
Parent Topic:Indicators