Adding indicators to Internal TI list

On the Indicators page, you can add an indicator to the Internal TI list with or without attributes. To access this page, you need to switch to the Data management mode.

To add an indicator with attributes:

1. Click the Add indicator button.

   The Add indicator window opens.

2. Select the indicator type.
3. Specify the indicator value.

   Kaspersky CyberTrace will apply URL normalization rules to any URL that you add and that is not yet contained in the indicator database. Thus, the representation of a URL may change. For example, if you add a URL that contains a port, the port value will be removed.

4. Add indicator attributes by specifying their names and values.

   The name can be up to 255 characters in length, must contain only lowercase Latin letters, and cannot begin with a hyphen ("-") or an underscore ("_"). The space character (" ") and the tab character cannot be used. Also, the attribute name cannot be equal to summary.

5. In the text field, enter summary information about the indicator, if necessary.
6. Click the Add button.

The indicator is added to the database with the InternalTI value of the supplier_name attribute.

To add one or several indicators without attributes:

1. Click the Manage Internal TI list button.
2. Select the indicator type.
3. Enter each value in a new line.

   Kaspersky CyberTrace will apply URL normalization rules to any URL that you add and that is not yet contained in the indicator database. Thus, the representation of a URL may change. For example, if you add a URL that contains a port, the port value will be removed.

4. Click the Save button.

The indicators are added to the database and assigned the InternalTI value of the supplier_name attribute.

Page top