Get started with Threat Intel Management

Get started with Threat Intel Management in Cortex XSOAR 8.10 On-prem.

Before diving in, you should understand the Cortex XSOAR Threat Intelligence Management's functionality and how it integrates with your needs. Review the use cases and key details to optimize your Cortex XSOAR experience from the start. Threat Intel management includes the following features:

• Access to Unit 42 Intel data
• Investigate files using sample analysis
• Submit Sessions and Submissions

  Note

  By default, the Palo Alto Networks Wildfire Reports integration, which is used as part of the sample analysis feature, is installed and configured for TIM customers. The Palo Alto Networks Wildfire v2 integration, for dynamic malware analysis, is also installed, but you must add an integration instance. No API key is required.
• Manage Indicator Relationships
• Deep dive into an indicator on the Threat Intel page.
• Customize an indicator layout
• Manage TIM reports

Note

Although some features are available without a TIM license such as indicator customization, you must have the Cortex XSOAR Threat Intel Management (TIM) license to use the TIM features.