> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-management.md). # Indicator management **Indicator management** Indicators are artifacts associated with security issues and are an essential part of the case management and remediation process. They help correlate issues, create hunting operations, and enable you to easily analyze cases and reduce Mean Time to Response (MTTR). **Indicators** Displays a list of indicators added to Cortex XSIAM, where you can perform several indicator actions. You can perform the following actions on the **XSIAM Indicators** page. | Action | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Investigate an indicator | Click on an indicator to view and take action on the indicator. | | Create an indicator |

Indicators are added to the indicators table from feed integrations or you can manually create a new indicator in the system.

When creating an indicator, in the Verdict field, you can either select a Verdict or leave it blank to calculate it later by clicking Save & Enrich, which updates the indicator from enrichment sources. After you select an indicator type, you can add any custom field data.

| | Edit | Edit a single indicator or select multiple indicators to perform a bulk edit. | | Delete and Exclude |

Delete and exclude one or more indicators from all indicator types or a subset of indicator types.

If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted.

| | Export CSV | Export the selected indicators to a CSV file. | | Export STIX | Export the selected indicators to a STIX file. | | Upload a STIX file | To upload a STIX file, click the upload button (top right of the page) and add the indicators from the file to the system. | **Indicator Rules** The **Indicator Rules** page is located under the **Threat Management** → **Detection Rules** menu and displays the following fields for each rule. For more information, see [Generate issues from indicators using indicator rules for prevention and detection](/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/generate-issues-from-indicators-using-indicator-rules-for-prevention-and-detection.md). | Field | Description | | --------------------- | ----------------------------------------------------------------- | | **Rule ID** | Unique identifier for the rule. | | **Creation Date** | Timestamp of when the rule was created. | | **Modification Date** | Timestamp when the rule was edited. | | **Name** | Name of the rule. | | **Type** | Whether the rule is a **Prevention** or **Detection** type rule. | | **Target** | Hash, IP address, File, or domain value associated with the rule. | | **Severity** | Level of severity associated with the rule. | | **# of issues** | Number of issues generated by the rule. | | **Created by** | The email address of the user who created the rule. | | **Description** | An optional description associated with the rule. | | **Status** | Whether the rule is **Enabled** or **Disabled**. | | **Used in profiles** | Cortex XDR agent Restriction Profile associated with the rule. | {% hint style="info" %} ### Note If an indicator matches multiple indicator rules, the highest severity rule is used. If all have the same severity, the rules are used by the first created. {% endhint %} In the **Indicator Rules** table, right-click a rule to perform actions, including the following: | Action | Description | | ----------------------- | -------------------------------------------------------------------- | | **View related issues** | View issues generated by the rule. | | **Disable/Enable** | Depending on the current status, **Disable** or **Enable** the rule. | | **Edit Rule** | Modify the rule. | | **Save as new** | Create a new rule using the current rule configurations. | | **Delete** | Delete the rule. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.