View and Manage Observables

The Observables page displays all successfully ingested observables; see Observable Summary Information.

Before you begin

Step 1	Choose Intelligence > Sources.
Step 2	Click Observables.
Step 3	View your current observables: To filter the observables displayed on the page, click Filter (). For more information, see Filter Threat Intelligence Director Data in Table Views. If the information in the Value column is cut off, hover over the value. To view indicators that contain the observable, click the number in the Indicators column. The Incidents page opens with the observable value as the filter. For more information, see View and Manage Indicators.
Step 4	Manage your current observables: To edit the Action, see Edit Threat Intelligence Director Actions at the Source, Indicator, or Observable Level. To edit an observable's Publish setting, see Pause or Publish Threat Intelligence Director Data at the Source, Indicator, or Observable Level. To change an observable's expiration date, modify the TTL for the parent source. For more information, see View and Manage Sources. To add an observable to the Do Not Block list, click the Add to Do-Not-Block List button. For more information, see About Adding Threat Intelligence Director Observables to the Do Not Block List.