Browsing detailed information about indicators

You can learn more about the indicators from the table by clicking the indicator that you want. You will go to a page that will provide you with the following information:

• Type of the requested indicator

  An indicator can be of several types (for example, IP and URL).

• Value of the requested indicator
• Date and time when the requested indicator was added
• Date and time of the earliest and latest detections of the requested indicator
• Date and time of the latest indicator update
• Mark indicating whether the requested indicator belongs to the FalsePositive supplier
• List of event sources that are associated with the requested indicator
• List of tags assigned to the indicator

On this page, you can perform the following actions:

• Mark the indicator as a false positive or remove the indicator from the list of false positives

  An indicator can be of several types. In this case, you will be asked which type of indicator to mark as a false positive or delete from the list of false positives.

• Delete the indicator

  Deleting indicators is available only if you have the Administrator role.

• View the indicator on a graph
• View detections related to the indicator
• View information about the indicator on Kaspersky Threat Intelligence Portal
• Enable or disable a flag that indicates whether to generate detection alerts when the matching process is complete
• Add the indicator to the InternalTI supplier, including adding or changing context information and summary

  An indicator can be of several types. In this case, you will be able to add each type of the indicator to the Internal TI list separately.

• Remove the indicator from the InternalTI supplier

  An indicator can be of several types. In this case, you will be able to remove each type of the indicator from the Internal TI list separately.

• Assign or remove tags
• Add or delete comments related to the indicator

Page top