About Pausing Publishing

If you pause publishing at the feature level, the system purges all threat intelligence director observables stored on your elements. This means that threat intelligence director cannot detect, monitor or block threats. Other security features on your system are not affected.

If you pause publishing at the source, indicator, or observable level, the system removes the paused threat intelligence director observables from your elements, preventing them from matching traffic.

Pausing publication for a parent pauses all children. If you pause publishing at the source level, you pause publishing for all its indicators. If you pause publishing at the indicator level, you pause publishing for all of its observables.

Pausing publication for a child interrupts inheritance. If you pause publishing at the indicator level, and subsequently publish at the source level, publishing for the indicator remains paused until you change the individual setting for the indicator. If you pause publishing at the observable level, and subsequently publish at the indicator level, publishing for the observable remains paused until you change the individual setting for the observable. At the observable level, you can revert automatically to the parent indicator's publishing status. For more information about inheritance, see Inheritance in Threat Intelligence Director Configurations.

Publishing for Uploaded sources can only be paused at the indicator level.

For a comparison of pausing publishing for an observable vs adding the observable to the Do Not Block list, see About Adding Threat Intelligence Director Observables to the Do Not Block List.

If you have specified a publish/pause setting for an individual observable or indicator, source updates do not change that setting if the update contains the same observable or indicator.

Publishing can be disabled on the object management pages. See Modify the Observable Publication Frequency.

The option on the Sources page to pause updates is not related to publishing data to elements; it applies to updating sources on the management center from feeds.