> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md).
# Indicator concepts
Before you start customizing and investigating you should be familiar with the following terms
**Indicators of Compromise**
Indicators of compromise (Indicators) are artifacts that can signal a security breach has occurred and are associated with security issues. They help correlate issues, create hunting operations, and enable you to easily analyze issues and reduce Mean Time to Response (MTTR). They are an essential part of the case management and remediation process. Indicators can include:
* IP addresses: Unusual or foreign IP address accessing your network
* Hashes: Unique identifiers for files or malware
* Domain names: Suspicious or malicious domains
* Registry entries: Changes to the system registry
**Fetch indicators**
Cortex AgentiX includes integrations that fetch indicators from a vendor-specific source, such as TAXII, or a generic source, such as a CSV or JSON file. For more information about how to set up a Threat Intel feed integration to fetch indicators, see [Configure Threat Intelligence feed integrations](/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-feed-integrations.md).
**Indicator ingestion**
Cortex AgentiX automates threat intel management by ingesting and processing indicator sources, such as feeds and lists, and exporting the enriched intelligence data to SIEMs, firewalls, and any other system that can benefit from the data. These capabilities enable you to sort through millions of indicators daily and take automated steps to make those indicators actionable in your security posture.
{% hint style="info" %}
### Note
You can store up to 100,000,000 indicators.
{% endhint %}
Indicators are added to Cortex AgentiX via the following methods:
| Method | Description | Classification and Mapping |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Integration | Feed integrations: Fetch indicators from a feed, for example, TAXII, Office 365, and Unit 42 Feed. | |
| Indicator extraction | | Only the value of an indicator is extracted, so no classification or mapping is needed. |
| Manual | - Command line
- Mark: The user marks a piece of data as an indicator.
- STIX file: Manually upload a STIX file on the AGENTIX Indicators page.
| Data is inserted manually via the UI so no classification or mapping is needed.
If importing a STIX file, mapping is done via the STIX parser code.
|
**Common indicator data model**
When indicators are ingested, regardless of their source, they have a unified, common set of indicator fields, including traffic light protocol (TLP), expiration, verdict, and tags.
**Indicator smart merge**
The same indicator can originate from multiple sources and be enriched with multiple methods (such as integrations, scripts, and playbooks). Cortex AgentiX implements a smart merge logic to make sure indicators are accurately scored (verdict) and aggregated. Indicator fields are merged according to the source reliability hierarchy. When there are two different values for a single indicator field, the field is populated with the value provided by the source with the highest reliability score. For multi-select and tag fields, new values are appended, rather than replacing the original values.
**Indicators enrichment cache (Insightcache)**
To avoid exceeding API quotas for third-party services, indicators are only updated after the cache expiration period. By default, the cache expires 4,320 minutes (3 days) after an indicator is updated, and cannot be cleared manually. The cache expiration can be set in the indicator type parameters. Indicator enrichment cache expiration only applies to automatic enrichment, triggered by the `enrichIndicators` command, and does not apply when you run reputation commands, such as `!ip, directly`.
**Indicator timeline**
The indicator timeline displays an indicator’s complete history, such as the first-seen and last-seen timestamp and changes made to indicator fields.
**Indicator expiration**
When ingesting and processing many indicators daily, it’s important to control whether or not they are active or expired and to define how and when indicators are expired. Cortex AgentiX offers multiple options to set indicator expiration. To configure how to expire an indicator, see [Configure indicator expiration](/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md).
**Exclusion list**
Indicators added to the exclusion list are disregarded by the system and are not created or involved in automated flows such as indicator extraction. For more information, see [Delete and exclude indicators](/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md).
**Jobs**
Administrators can define a job to trigger a playbook when the specified feed or feeds finish a fetch operation that includes a modification to the list. The modification can be a new indicator, a modified indicator, or a removed indicator.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.