Inheritance in Threat Intelligence Director Configurations

When threat intelligence director ingests intelligence data from a source, it creates indicators and observables as child objects of that source. On creation, these child objects inherit Action and Publish settings from the parent configuration.

An indicator inherits these settings from the parent source. An indicator can only have one parent source.

An observable inherits these settings from the parent indicator(s). An observable can have multiple parent indicators.

For more information, see:

• Inheritance of TID Settings from Multiple Parents

• About Overriding Inherited TID Settings