> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md).
# Threat Intel Management use cases
Explore Threat Intel Management use cases in Cortex AgentiX.
The following examples illustrate typical use cases for Threat Intel Management analysts.
Dynamic allow lists for business-critical SaaS apps
In this example, Firewall Admins are responsible for ensuring employees can always access SaaS applications such as Zoom and Office 365. They need to manage a stream of inbound change requests from the security team and other business units. Regardless of these daily changes, critical apps must always be allowed. The network infrastructure of SaaS applications is constantly changing/rotating IP addresses and Domains.
1. Configure a feed integration such as Office 365, Amazon AWS, or Unit 42.
1. Navigate to **Settings** → **Data Sources & Integrations**.
2. Search for and select the relevant integration and click **Add Instance**.
In this example, add the AWS feed.
3. Set up the instance. In the **Indicator Reputation** field, select **Benign**.
4. Test and save the instance.
2. (Optional) Configure a playbook to filter indicators according to your requirements.
3. Go to the Indicators page and run the following search to return IP, IPv6 or IPv6CIDR results:
`sourceBrands:"AWS Feed" and expirationStatus:active and type:IP or type:IPv6 or type:IPv6CIDR`
4. Configure the Generic Export Indicator Service integration.
1. On the **Data Sources & Integrations** page, search for and select Generic Export Indicators Service, and click **Add Instance**.
2. In the **Indicator Query** field, add the query in step 3.
3. Add the remaining fields, test, and save.
5. Test the EDL by running the cURL command: `curl -v-u- user:pass https://ext-crtx.paloaltonetworks.com/xsoar/instance/execute/`
Proactive blocking of known threats
The security team needs to leverage threat intelligence to block or alert on known bad domains, IPs, hashes, etc. (indicators). The indicators are collected from many sources, which need to be normalized, scored, and analyzed before pushing to security devices such as firewalls for alerting. Detection tools can only handle limited amounts of threat intelligence data and need to constantly re-prioritize indicators.
**Solution**
Indicator prioritization. Cortex AgentiX can ingest phishing issues from email inboxes through integrations. Once an issue is ingested, a playbook is triggered and can have any combination of automated or manual actions that users desire. The playbooks can have filters and conditions that execute different branches depending on certain values.
1. Configure feed integrations such as Unit 42 Feed, TAXII feed, etc.
1. Navigate to **Settings** → **Data Sources & Integrations**.
2. Search for and select the relevant threat intel feed integration and select **Add Instance**.
3. Set up the instance.
Leave the **Indicator Reputation** field blank.
4. Test and save the instance,
2. (Optional) Configure a playbook to filter indicators according to your requirements.
3. Go to the **AGENTIX Indicators** page and run the following search to return IP addresses with the verdict malicious with high reliability:
`expirationStatus:active and type:IP and verdict:malicious and aggregatedReliablitiy:A - Completely reliable`
4. Configure the Generic Export Indicator Service integration.
1. Navigate to **Settings** → **Data Sources & Integrations**.
2. Search for and select Generic Export Indicators Service and click **Add Instance**.
3. In the **Indicator Query** field, add the query in step 3.
4. Add the remaining fields, test, and save.
5. Test the EDL by running the cURL command: `curl -v-u- user:pass https://ext-crtx.paloaltonetworks.com/xsoar/instance/execute/`
You can use this URL in your Next-Generation Firewall.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.