Home

Location

Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base

Home
Security Operations
Cortex XSOAR
Cortex XSOAR Threat Intel Management Guide
Threat Intel Management Playbooks

Last Updated:

Jun 13, 2022

Current Version:

6.2 (EoL)

Version 6.9
Version 6.8
Version 6.6
Version 6.5
Version 6.2 (EoL)
Version 6.0 (EoL)

End-of-Life (EoL)

Table of Contents

Filter

Threat Intel Management Overview

Threat Intel Concepts

Manage Indicators

Understand Indicators

Threat Intel Page

Export an Indicator to CSV Using the UTF8-BOM Format

Indicator Verdict

Indicator Expiration

Indicator Types

Create an Indicator Type

Indicator Type Profile

File Indicators

File Indicator Merging Strategy

Indicator Fields

Create a Custom Indicator Field

Configure the HTML Field

Map Custom Indicator Fields

Customize Indicator View Layouts

Customize an Indicator Type Layout

Add a Script in the Indicator Layout

Exclusion List

Create a Feed-Triggered Job

Manage the Indicator Timeline

Indicator Extraction

Create Indicator Extraction Rules for an Incident Type

Configure What Indicator Extraction Executes

Run Indicator Extraction in the CLI

Create Indicator Extract Rules for a Playbook Task

Disable Indicator Extraction for Automations or Integrations

Indicator Relationships

Create Indicator Relationships

Leverage Relationships in the Canvas

Threat Intel Feeds

Feed Integrations

Set the Source Reliability of Enrichment Integrations

Threat Intel Management Playbooks

Create a TIM Playbook

Export Indicators

Manually Export Indicators

Export Indicators Integrations

Export Indicators Playbooks

Threat Intel Management Overview
- Threat Intel Concepts
Manage Indicators
Threat Intel Feeds
- Feed Integrations
- Set the Source Reliability of Enrichment Integrations
Threat Intel Management Playbooks
- Create a TIM Playbook
Export Indicators

Document:Cortex XSOAR Threat Intel Management Guide

Threat Intel Management Playbooks

Last Updated:

Jun 13, 2022

Current Version:

6.2 (EoL)

Version 6.9
Version 6.8
Version 6.6
Version 6.5
Version 6.2 (EoL)
Version 6.0 (EoL)

Table of Contents

Filter

Threat Intel Management Overview

Threat Intel Concepts

Manage Indicators

Understand Indicators

Threat Intel Page

Export an Indicator to CSV Using the UTF8-BOM Format

Indicator Verdict

Indicator Expiration

Indicator Types

Create an Indicator Type

Indicator Type Profile

File Indicators

File Indicator Merging Strategy

Indicator Fields

Create a Custom Indicator Field

Configure the HTML Field

Map Custom Indicator Fields

Customize Indicator View Layouts

Customize an Indicator Type Layout

Add a Script in the Indicator Layout

Exclusion List

Create a Feed-Triggered Job

Manage the Indicator Timeline

Indicator Extraction

Create Indicator Extraction Rules for an Incident Type

Configure What Indicator Extraction Executes

Run Indicator Extraction in the CLI

Create Indicator Extract Rules for a Playbook Task

Disable Indicator Extraction for Automations or Integrations

Indicator Relationships

Create Indicator Relationships

Leverage Relationships in the Canvas

Threat Intel Feeds

Feed Integrations

Set the Source Reliability of Enrichment Integrations

Threat Intel Management Playbooks

Create a TIM Playbook

Export Indicators

Manually Export Indicators

Export Indicators Integrations

Export Indicators Playbooks

Threat Intel Management Overview
- Threat Intel Concepts
Manage Indicators
Threat Intel Feeds
- Feed Integrations
- Set the Source Reliability of Enrichment Integrations
Threat Intel Management Playbooks
- Create a TIM Playbook
Export Indicators

End-of-Life (EoL)

Threat Intel Management Playbooks

TIM playbooks

Create a TIM Playbook

Most Popular

Recommended For You

Recommended Videos

Recommended videos not found.

© 2022 Palo Alto Networks, Inc. All rights reserved.