> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators/indicator-field-structure.md).

# Indicator field structure

Learn about the default fields for extended threat intelligence (XTI) indicators.

XTI indicator default fields are system fields created and managed by Cortex. These fields are displayed on the Indicators page and in indicator overview and details for all the indicator types that they are applicable to. Third party indicator fields are mapped to these default fields whenever possible. Any third-party indicator field that is not mapped to a default field is considered a custom field. This documentation describes the XTI indicator default fields.

XTI indicators are STIX Cyber-observable Objects (SCOs) based on the STIX 2.1 specifications. XTI supports the following indicator types:

* **Domain**: Represents a network domain name, similar to the STIX Domain Name object.
* **File hash**: Represents a single file hash using the SHA-256 algorithm.
* **IP address**: Represents an IPv4 address.
* **URL**: Represents a Uniform Resource Locator (URL).

The following table describes the fields available for all available indicator types.

* The **Field** column provides the name of the field displayed on the user interface.
* The **Indicator type** column indicates whether the field is available for all indicator types or for a specific indicator type only.
* The **XQL attribute** column matches the field to the corresponding attribute in the threat\_intel\_indicators XQL dataset.
*

<table data-header-hidden><thead><tr><th>Field</th><th width="88.79296875">Indicator type</th><th width="254.74609375">Description</th><th width="188.27734375">Example value</th><th width="141.76953125">Data type</th><th width="167.1484375">XQL attribute</th></tr></thead><tbody><tr><td><strong>Field</strong></td><td><strong>Indicator type</strong></td><td><strong>Description</strong></td><td><strong>Example value</strong></td><td><strong>Data type</strong></td><td><strong>XQL attribute</strong></td></tr><tr><td>Value</td><td>All</td><td>The specific IP address, domain name, URL, or hash value</td><td>wemobiledauk.com</td><td>Text</td><td><em>value</em></td></tr><tr><td>ID</td><td>All</td><td>The unique identifier for the object in the STIX format (e.g., account--&#x3C;UUID>, indicator--&#x3C;UUID>, or malware--&#x3C;UUID>)</td><td>domain-name--91711f57-ec67-5bfc-af8b-fbaba4c9bb52</td><td>Text</td><td><em>id</em></td></tr><tr><td>Type</td><td>All</td><td>The indicator type: Domain, File Hash, IP, or URL</td><td>Domain</td><td>Enumeration</td><td><em>type</em></td></tr><tr><td>Verdict</td><td>All</td><td>The classification of the indicator, which can be Malicious, Suspicious, Benign, or Unknown</td><td>Malicious</td><td>Enumeration</td><td><em>verdict</em></td></tr><tr><td>Verdict Categories</td><td>All</td><td>The internal sources and category values that contribute to an indicator's overall verdict.</td><td>DNS: allowlist</td><td>JSON</td><td><em>verdict_categories</em></td></tr><tr><td>Custom Fields</td><td>All</td><td>Custom fields that are not mapped to default fields.</td><td>–</td><td>JSON</td><td><em>custom_fields</em></td></tr><tr><td>Description</td><td>All</td><td>A detailed definition of the object on Cortex.</td><td>Banking trojan and malware loader</td><td>Text</td><td><em>description</em></td></tr><tr><td>First Seen</td><td>All</td><td>The timestamp indicating when the indicator was first observed in the environment</td><td>Jan 10th 2026 08:00:00</td><td>Timestamp</td><td><em>first_seen</em></td></tr><tr><td>Last Seen</td><td>All</td><td>The timestamp indicating the most recent time the indicator was observed</td><td>Mar 15th 2026 12:30:00</td><td>Timestamp</td><td><em>last_seen</em></td></tr><tr><td>Created at</td><td>All</td><td>The timestamp for when the indicator record was created in the system<br><br></td><td>Feb 5th 2026 20:12:44</td><td>Timestamp</td><td><em>created</em></td></tr><tr><td>Last Updated</td><td>All</td><td>The timestamp for the most recent modification to the indicator's metadata or status<br><br></td><td>May 19th 2026 18:00:00</td><td>Timestamp</td><td><em>last_updated</em></td></tr><tr><td>Expiration Status</td><td>All</td><td>The current status of the indicator's lifecycle (e.g., Active or Expired). Its value is derived at read time from the Expired on timestamp.</td><td>Active</td><td>Enumeration</td><td><em>expiration_status</em></td></tr><tr><td>Created by User</td><td>All</td><td>The name or email of the specific user who manually created or imported the indicator<br><br></td><td>Alice Jones</td><td>Text</td><td><em>created_by_user</em></td></tr><tr><td>Created by Source Brand</td><td>All</td><td>The name of the vendor or source brand (e.g., Unit 42, VirusTotal) that initially provided the indicator</td><td>Unit42</td><td>Text</td><td><em>created_by_source_brand</em></td></tr><tr><td>Created by Source Instance</td><td>All</td><td><p>The specific instance of an integration that first ingested the indicator</p><p><br></p></td><td>unit42-instance-1</td><td>Text</td><td><em>created_by_source_instance</em></td></tr><tr><td>Creation Method</td><td>All</td><td>The method used to ingest the indicator into the system (Ingestion, User, Enrichment, Automation, Third Party Feed, or Third Party Enrichment)<br><br></td><td>Ingestion</td><td>Enumeration</td><td><em>creation_method</em></td></tr><tr><td>Last Updated by User</td><td>All</td><td>The specific user who performed the most recent manual update (e.g., a verdict override).</td><td>Alice Jones</td><td>Text</td><td><em>last_updated_by_user</em></td></tr><tr><td>Last Updated by Source Brand</td><td>All</td><td>The vendor or source brand that provided the data for the most recent automatic update</td><td>Unit42</td><td>Text</td><td><em>last_updated_by_source_brand</em></td></tr><tr><td>Last Updated by Source Instance</td><td>All</td><td>The specific integration instance that performed the most recent update</td><td>unit42-instance-1</td><td>Text</td><td><em>last_updated_by_source_instance</em></td></tr><tr><td>Last Update Method</td><td>All</td><td>The method by which the indicator was last modified (Ingestion, User, Enrichment, Automation, Third Party Feed, or Third Party Enrichment).</td><td>User</td><td>Enumeration</td><td><em>last_modification_method</em></td></tr><tr><td>Updated by Source Brands</td><td>All</td><td>A cumulative list of all source brands that have contributed updates to this indicator</td><td>Unit42, User</td><td>Array</td><td><em>updated_by_source_brands</em></td></tr><tr><td>Updated by Source Instances</td><td>All</td><td>A cumulative list of all integration instances that have contributed updates to this indicator</td><td>unit42-instance-1, af-instance-2</td><td>Array</td><td><em>updated_by_source_instances</em></td></tr><tr><td>Sources</td><td>All</td><td>A list of sources that have provided data for this indicator.</td><td>Unit42, User</td><td>Array</td><td>–</td></tr><tr><td>Tags</td><td>All</td><td>Metadata labels attached to the object, often used for categorization and filtering during investigations</td><td>apt, false-positive</td><td>Array</td><td><em>tags</em></td></tr><tr><td>Blocked</td><td>All</td><td>A Boolean switch (true/false) used to mark the object as blocked within the user's specific environment</td><td>True</td><td>Enum</td><td><em>blocked</em></td></tr><tr><td>Community Notes</td><td>All</td><td>A field for comments and free-form notes regarding the indicator, allowing for collaborative context or historical observations</td><td>Confirmed C2 domain</td><td>JSON</td><td><em>community_notes</em></td></tr><tr><td>Traffic Light Protocol</td><td>All</td><td>A set of designations (Red, Amber, Green, or Clear/White) used to ensure that sensitive information is shared with the appropriate audience</td><td>Green</td><td>Enumeration</td><td><em>tlp</em></td></tr><tr><td>SHA1</td><td>File</td><td>The SHA1 hash</td><td>da39a3ee5e6b4b0d3255bfef95601890afd80709</td><td>Text</td><td><em>file_attributes.sha1</em></td></tr><tr><td>MD5</td><td>File</td><td>The MD5 hash</td><td>d41d8cd98f00b204e9800998ecf8427e</td><td>Text</td><td><em>file_attributes.md5</em></td></tr><tr><td>SHA512</td><td>File</td><td>The SHA512 hash</td><td>cf83e1357eefb8bdf1542850d66d8007d620e405...</td><td>Text</td><td><em>file_attributes.sha512</em></td></tr><tr><td>SSDeep</td><td>File</td><td>The SSDeep hash</td><td>3:AXGBicFlgVNhBGCb4G7:AXGBiFNhxkv</td><td>Text</td><td><em>file_attributes.ssdeep</em></td></tr><tr><td>Imphash</td><td>File</td><td>The imphash</td><td>f34d5f2d4577ed6d9ceec516c1f5a744</td><td>Text</td><td><em>file_attributes.imphash</em></td></tr><tr><td>File Type</td><td>File</td><td>The type of the file</td><td>PE32 executable</td><td>Text</td><td><em>file_attributes.file_type</em></td></tr><tr><td>File Size</td><td>File</td><td>The file size</td><td>245760</td><td>Integer</td><td><em>file_attributes.file_size</em></td></tr><tr><td>File Extension</td><td>File</td><td>The file extension</td><td>.exe</td><td>Text</td><td><em>file_attributes.file_extension</em></td></tr><tr><td>Associated File Names</td><td>File</td><td>Names the file is associated with</td><td>malware.exe, payload.dll</td><td>Array</td><td><em>file_attributes.associated_file_names</em></td></tr><tr><td>File Creation Date</td><td>File</td><td>The file creation date</td><td>Jan 15th 2026 10:30:00</td><td>Timestamp</td><td><em>file_attributes.file_creation_date</em></td></tr><tr><td>File Path</td><td>File</td><td>The path to the file</td><td>C:\Users\Admin\Downloads\malware.exe</td><td>Text</td><td><em>file_attributes.file_path</em></td></tr><tr><td>Quarantined</td><td>File</td><td>Indicates if the file was quarantined (True or False)</td><td>True</td><td>Enumeration</td><td><em>file_attributes.quarantined</em></td></tr><tr><td>DNS Records</td><td>Domain</td><td>All types of DNS records with a timestamp and their values (GRID)</td><td>Type: A</td><td>JSON</td><td><em>dns</em></td></tr><tr><td>Certificates</td><td>Domain, URL</td><td>Any certificates issued for the domain</td><td>Let's Encrypt: 01:AB:CD</td><td>JSON</td><td><em>certificates</em></td></tr><tr><td>WHOIS Records</td><td>Domain, IP</td><td>Any records from WHOIS about the domain (GRID)</td><td>Name Servers: udns1.csudns.com</td><td>JSON</td><td><em>whois</em></td></tr><tr><td>Geo Country</td><td>IP</td><td>The country where the object is located</td><td>United States</td><td>Text</td><td><em>geo.country</em></td></tr><tr><td>Geo Region</td><td>IP</td><td>The region where the object is located</td><td>United States</td><td>Text</td><td><em>geo.location</em></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators/indicator-field-structure.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.