Edit Private Indicator

You can edit a private indicator to update it with new findings or to change the expiration date.

Perform the following steps to edit a private indicator:

1. Choose Intelligence > Indicators in the navigation menu and click the Private tab to display the list of private indicators.



2. Click the indicator Title to open the Indicator Details drawer.



3. Click Edit in the lower portion of the drawer to open the Edit Indicator drawer.



Note: You can also edit a private indicator from the Full Indicator page. Click View Full Indicator in the lower portion of the Indicator Details drawer and then click Edit in the upper right corner on the Full Indicator page.

4. Modify any of the information:

Field	Description
Title	Short descriptive title to be used as the primary display and reference value.
Expiration	Required. The time range for which the indicator is valid. By default, indicators are set to never expire. If you want to specify an expiration date, uncheck the Never expires check box and pick a date on the calendar.
Description	Descriptive summary of the indicator that provides more details.
Short Description	A single line, short summary of the indicator.
Likely Impact	Expected impact within the relevant context if the indicator occurs.
Tags	Enter searchable descriptors for the indicator, separated by commas.
External ID	External reference ID. Click Add External ID and enter the external reference ID in the text box. You can enter multiple external IDs. To remove an external ID, click the Delete icon next to it.
Origin	Enter the origin information for the indicator: Source - Enter the title of the source of the indicator. Source URI - Enter the URL of the source of the indicator.
Flags	Specify the confidence, severity, and TLP designation for the indicator: Confidence - Click the option that indicates the level of confidence of the accuracy of the indicator. Severity - Click the option that indicates the severity level of the indicator. TLP - Click the option for the TLP designation.
Kill Chain Phases	Check the check boxes for all relevant kill chain phases indicated by the indicator.
Indicator Types	Type classifications to be assigned to the indicator. Check all of the check boxes of applicable types.
External References	Click Add External Reference and enter information about external sources of the indicator in the text box. You can add multiple external references. To remove an external reference, click the Delete icon next to it.

5. Click Save. A message is displayed in the lower right corner indicating the indicator has been updated.