View and Manage Indicators

To filter the indicators displayed on the page, click Filter (). For more information, see Filter Threat Intelligence Director Data in Table Views.

To view additional details about an indicator (including associated observables), click the indicator name. For more information, see Indicator Details.

In the Incidents column, click the number to view information about incidents associated with an indicator, or hover the cursor over Incidents to view whether the incidents are fully- or partially-realized.

To determine whether threat intelligence director finished ingesting an indicator from the source, view the Status column.

To edit the Action, see Edit Threat Intelligence Director Actions at the Source, Indicator, or Observable Level. If an action is fixed, it is the only supported action for the source Type.

To edit the Publish setting, see Pause or Publish Threat Intelligence Director Data at the Source, Indicator, or Observable Level.

To add one or more of an indicator's observables to the Do Not Block list, click the indicator name to access the Indicator Details page. For more information, see About Adding Threat Intelligence Director Observables to the Do Not Block List.