> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators/investigate-xti-indicators.md).
# Investigate XTI indicators
Investigate threat intelligence indicators, related detections, associations, and reports.
The **Indicators** page lists domains, IP addresses, URLs, and file hashes.
You can access it from **Threat Management → Threat Intelligence → Indicators**.
You can use this page to view data and discover relationships between specific indicators and the broader threat landscape. The main tab contains all indicators and you can also view dedicated tabs for **Domain**, **File Hash**, **IP**, and **URL** indicator types.
The widgets at the top of the page provide visualizations showing the breakdown of indicators by type, verdict, source, and associated threat objects. Click on the widget data to filter the indicator table below. If you would like to hide the widgets, click on **Hide Widgets**. You can display them again by clicking on **Show Widgets**.
### Filter the indicators
You can search and filter by various fields including indicator value, type, related threat actors, related malware families, verdict, tags, creation method, source brand, last seen, associated cases and issues, and more. You can customize the list of columns displayed if needed.
You can also use column-specific filters. For example, if you would like to view only Unit 42 indicators, you can filter for **Source Brand** equal to “Unit 42”. If you would like to view only third party indicators, you can filter for **Creation Method** equal to "Ingestion" and **Source Brand** not equal to “Unit 42”.
### View indicator details
When you select an indicator, a side pane opens, providing highlights designed for rapid tactical assessment and information about related threat actors and malware families.
* The **Overview** tab shows highlights such as sources, description, tags, verdict (and contributing verdicts), and associated threat objects.
* The **Details** tab displays both default and custom indicator fields. Cortex manages default fields and maps similar third-party attributes to them. The remaining fields are directly populated from third-party intelligence and shown as custom fields. Consequently, indicators from first-party Unit 42 intelligence contain only default fields, while third-party indicators contain both default and custom fields.
* The **Detections** tab lists cases and issues associated with the specific indicator, including cases based on direct IOC observation and cases based on Behavioral Threat Analysis (BTA). Select a **Cases** or **Issues** grouping to view cases or issues in a tabular view.
* The **Associations** tab lists related Threat Actors and Malware Families.
* The **Reports** tab shows reports related to the indicator.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators/investigate-xti-indicators.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
