View and manage indicators

To filter the indicators displayed on the page, click Filter (). For more information, refer to Filter Threat Intelligence Director data in table views.

To view additional details about an indicator, including associated observables, click the indicator name. For more information, refer to Indicator details.

In the Incidents column, click the number to view information about incidents associated with an indicator, or hover the cursor over Incidents to view whether the incidents are fully realized or partially realized.

To determine whether Threat Intelligence Director finished ingesting an indicator from the source, view the Status column.

To edit the Action, refer to Edit Threat Intelligence Director actions at the source, indicator, or observable Level. If an action is fixed, that is the only supported action for the source Type.

To edit the Publish setting, refer to Pause or publish Threat Intelligence Director data at the source, indicator, or observable Level.

To add one or more observables for an indicator to the Do Not Block list, click the indicator name to access the Indicator Details page. For more information, refer to Adding Threat Intelligence Director observables to the Do Not Block list.