Observable Summary Information

Type

The type of observable data: SHA-256, Domain, URL, IPv4, or IPv6.

Value

The data that comprises the observable.

Indicators

The number of parent indicators containing the observable.

Action

The action configured for the observable. For more information, see Edit Threat Intelligence Director Actions at the Source, Indicator, or Observable Level.

Indicators can inherit Action settings from a parent source, and observables can inherit Action settings from a parent indicator. For more information, see Inheritance in Threat Intelligence Director Configurations.

Publish

The publish setting for the observable; see Pause or Publish Threat Intelligence Director Data at the Source, Indicator, or Observable Level.

Indicators can inherit Publish settings from a parent source, and observables can inherit Publish settings from a parent indicator. For more information, see Inheritance in Threat Intelligence Director Configurations.

Updated At

The date and time threat intelligence director last updated the observable.

Expires

The date that the observable will be automatically purged from threat intelligence director based on TTL for the parent indicator.

Add to Do-Not-Block List button

Clicking this button adds the observable to the Do Not Block list; see About Adding Threat Intelligence Director Observables to the Do Not Block List.