Managing IoCs in the Threat Intelligence Platform

Using Filters

Click Filters to use defined filters.

To use defined filters:

• For Score, enter Min and Max using the up and down arrows.

  

  The limits are from 1 to 100. The Min must be less than the Max.

• For Creation Date, enter From and To dates and times using the calendars.

  

  Select a date, select a time, then click the checkmark.

  

• For Sources, select a source using the check boxes or Select All.

  

  To see more Sources, click View More.

• For Tags, select a tag using the check boxes or Select All.

  

  To see more Tags, click View More.

• If a defined filter is unselected, you can click the search box under Add new filter to select a filter from the dropdown.

  

To exit, click Filters again. The configured filters are displayed at the top of the table.

To clear an individual filter, click the icon to the right of the filter ().

To clear all filters, click Clear All.

Using Columns

Click Columns to add or remove columns using check boxes.

Click Columns again to exit.

Deleting IoCs

To delete an IoC, click the Trash icon () in the Actions column for a row in the table. The following confirmation is displayed.

Click Yes, permanently remove this IoC.

You can also click a check box on the left to select an IoC and then click the Trash icon ().

Reputation-based ML Alert Types and Rules

If there are IoCs in your domain, IP address, or URL-related fields, then fields such as source_reputation are enriched. The following IoC-based detection behavior is for Machine Learning (ML) alert types as well as rules.

See the following:

• ML Alert Types

• Rules

• Handling Alerts when Bad Reputation is True

ML Alert Types

Bad Destination Reputation Anomaly

This alert type detects generic bad destination reputations. If there is a spike of records that have such bad destination reputations, an ML alert is triggered.

The query is as follows:

_exists_:dstip_reputation AND NOT dstip_reputation:Good

The IoC source is any feeds or user-ingested IoCs.

Command & Control Reputation Anomaly

This alert type detects Command and Control-related reputations. If there is a spike of records that have such reputations, an ML alert is triggered.

The query is as follows:

(dstip_reputation:CnC OR dstip_reputation:SpywareCnc OR dstip_reputation:P2Pcnc OR dstip_reputation:Mobile_CnC OR dstip_reputation:Mobile_Spyware_CnC) AND (state:Closed OR state:Established)

The IoC source is Alienvault, ETPro IP, ETPro domain, or user-ingested IoCs that have the IoC tags that satisfy the query.

Scanner Reputation Anomaly

This alert type detects the Scanner, Phishing, or Spam reputations from the source IP address. If there is a spike of records that have such reputations, an ML alert is triggered.

The query is as follows:

(srcip_reputation:Scanner OR srcip_reputation:Phishing OR srcip_reputation:Spam) AND (state:Closed OR state:Established OR state:Aborted OR state:HalfOpened) AND NOT _exists_:event_source

The IoC source is Alienvault, DHS, ETPro IP, ETPro domain, Openphish (only Phishing), Phishtank (only Phishing), or user-ingested IoCs that have the IoC tags that satisfy the query.

Rules

File Hash Data Sources

The following data sources have file hash-related enrichment.

Alert Integrations

• Acronis Cyber Protect Cloud

• Avanan

• Deep Instinct

• ESET Protect

• LimaCharlie

• Microsoft Defender For Cloud Apps

• Mimecast

• Proofpoint Targeted Attack Protection (TAP)

• SentinelOne Cloud

• Sophos Central

• Trend Micro Vision One

• VMware Carbon Black Cloud

Parsers

• Centos Audit

• CheckPoint Harmony Endpoint

• Cisco Umbrella

• Linux Audit

• ThreatLocker Zero Trust EPP

Windows Event Parser

• IBM WinCollect

{
  "file": {
    "hash": {
      "md5": "030753fb7a8eff726297c9dbd734c9ea",
      "sha1": "c57e03c5865290efb13ff3e8505e229790cea835",
      "sha256": "04ddd4cec63dfe1d221c8afa51306a5fcb92abdef70a7a18d1b2a8f11add625d"
    },
    "threat_indicator": {
      "labels": [],
      "sources": ["DHS"],
      "score": 90,
      "file": {
        "hash": {
          "md5": "030753fb7a8eff726297c9dbd734c9ea",
          "sha1": "c57e03c5865290efb13ff3e8505e229790cea835",
          "sha256": "04ddd4cec63dfe1d221c8afa51306a5fcb92abdef70a7a18d1b2a8f11add625d"
        }
      }
    }
  }
}