Indicators

The Indicators tab provides the ability to search for stored public and private threat intelligence indicators that are deemed most relevant to incident response (for more information, see Intelligence).

An indicator describes a pattern of behavior or a set of conditions which indicate malicious behavior. Some indicators are more indicative than others of malicious behavior, so knowing exactly which bad behaviors an observable (such as a domain or an IP address) is exhibiting can help an incident responder decide what to do next.

The Public indicators are displayed by default. Click Private in the upper right corner to display the list of private indicators.

Indicators Table Column Descriptions

Column Name	Description
Title	Describes the full pattern of behavior or a set of conditions which indicate malicious behavior. A Short Description may also be displayed, if available. Click the (Sort) iconnext to the column heading to sort the list alphabetically (ascending or descending). Click the indicator Name to open the Indicator Details drawer and view additional information.
Modified	Date and time the data was last updated. Click the (Sort) icon next to the column heading to sort the list by oldest or most recent date and time.
Source	The source that reported the indicator to the Cisco XDR module.
TLP	Traffic Light Protocol designation that indicates how information should be shared (red, amber, green, or white).
Confidence	The confidence level of the system that produced the data of its accuracy.
Producer	Where the CTIM entity (data) originated, for example who encoded the intel into a data object.

From the Indicators tab, you can perform the following tasks:

Create Private Indicator

You can create a private indicator if you see a pattern of behavior or a set of conditions which indicate malicious behavior.

Choose Intelligence in the navigation menu and click the Indicators tab.
Click Private in the upper right corner to display the list of private indicators.
Click Create Indicator in the upper right corner to open the Create indicator drawer.

Form to create an indicator, including fields for title, expiration, descriptions, impact, tags, and external ID.

Complete the form:

Field	Description
Title	Enter a short descriptive title to be used as the primary display and reference value.
Expiration	Required. By default, indicators are set to never expire. If you want to specify an expiration date, uncheck the Never expires check box and pick a date on the calendar.
Description	Enter a descriptive summary of the indicator that provides more details.
Short Description	Enter a single line, short summary of the indicator.
Likely Impact	Enter the expected impact within the relevant context if the indicator occurs.
Tags	Enter searchable descriptors for the indicator, separated by commas.
External ID	Click Add External ID and enter the external reference ID in the text box. You can enter multiple external IDs. To remove an external ID, click the Delete icon next to it.
Origin	Enter the origin information for the indicator: Source - Enter the title of the source of the indicator. Source URI - Enter the URL of the source of the indicator.
Flags	Specify the confidence, severity, and TLP designation for the indicator: Confidence - Click the option that indicates the level of confidence of the accuracy of the indicator. Severity - Click the option that indicates the severity level of the indicator. TLP - Click the option for the TLP designation.
Kill chain phases	Check the check boxes for all relevant kill chain phases indicated by the indicator.
Indicator Type	Check the check boxes for all applicable type classifications to be assigned to the indicator.
External references	Click Add external reference and enter information about external sources of the indicator in the text box. You can add multiple external references. To remove an external reference, click Remove.

Click Save. A message is displayed in the lower right corner indicating the new indicator has been created.

View Indicator Drawer

Click the indicator title to open the Indicator drawer and view additional information, download the indicator in JSON format, edit or delete a private indicator, and view the Indicator Detail page.

General

Expand the General panel in the Indicator drawer and view the following information:

Modified	Date and time the data was last updated.
Producer	Where the CTIM entity (data) originated, for example who encoded the intel into a data object.
Source	The Cisco XDR module where the indicator was produced.
TLP	Traffic Light Protocol designation that indicates how information should be shared (red, amber, green, or white).