Source Summary Information

Name

The source name.

Type

The data format of the source (STIX or Flat File).

Delivery

The method threat intelligence director uses to retrieve the source.

Action

The action (Block or Monitor) that the system is configured to perform on traffic matching the data contained within this source.

For more information about threat intelligence director actions, including availability, inheritance, and overriding inheritance, see Factors That Affect the Action Taken.

Publish

On or Off toggle specifying whether threat intelligence director publishes data from the source to registered elements (managed devices configured to support threat intelligence director).

Indicators can inherit Publish settings from a parent source, and observables can inherit Publish settings from a parent indicator. For more information, see Inheritance in Threat Intelligence Director Configurations.

Last Updated

The date and time threat intelligence director last updated the source.

Status

The current status of the source:

• New—The source is newly created.

• Scheduled—The initial download or subsequent update is scheduled, but not yet in progress.

• Downloading—threat intelligence director is performing the initial download or update refresh.

• Parsing or Processing—threat intelligence director is ingesting the source.

• Completed—threat intelligence director finished ingesting the source.

• Completed with Errors—threat intelligence director finished ingesting the source, but some observables are unsupported or invalid.

• Error—threat intelligence director experienced a problem. If the source is a TAXII or URL source with an Update Frequency specified, and updates are not paused, threat intelligence director retries on the next scheduled update.

Refresh the page to update the status.

Edit ()

Clicking this icon allows you to edit settings for the source.

Delete ()

Clicking this icon permanently deletes the source.