> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md).
# Indicator investigation
Investigate indicators and relationships in Cortex XSOAR 8.10 On-prem.
Cortex XSOAR enables you to centralize and manage every aspect of your TIM investigation. Create, extract, and enrich indicators using Unit 42 Intel data and explore their relationships to gain deeper insights.
After you start ingesting indicators into Cortex XSOAR, you can start your investigation, including creating indicators, adding indicators to an incident, extracting indicators, exporting indicators, etc.
Cortex XSOAR Threat Intel includes access to the Unit 42 Intel service, enabling you to identify threats in your network and discover and contextualize trends. Unit 42 Intel provides data from WildFire (Palo Alto Networks’ cloud-based malware sandbox), the PAN-DB URL Filtering database, Palo Alto Networks’ Unit 42 threat intelligence team, and third-party feeds (including both closed and open-source intelligence). Unit 42 Intel data is continually updated to include the most recent threat samples analyzed by Palo Alto Networks, enabling you to keep up with threat trends and take a proactive approach to securing your network.
When investigating an indicator, you can see the following tabs:
* **Summary**
View verdict, enrich, expire, delete and exclude the indicator, add relationships, view related incidents, and add comments. Add or remove tags, which can help classify known threats. For example, you may want to group specific malware indicators that are part of ransomware, such as trojan or loader. Unit 42 Intel data also publishes tags to assist your classification.
* **Additional Details**
Add or view any community notes for sharing and any custom details.
* **Unit 42 Intel**
If the indicator is available in Unit 42, you can view related Unit 42 Intel data.
If the indicator has been found in the Unit 42 database you can view the following information (and download the Wildfire report (if available), according to indicator type:
Available data according to indicator type
| Indicator Type | Layout Sections |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| IP address | - Verdict
- Source
- Relationships
- PAN-DB Categorization
- Passive DNS
|
| URL | - Verdict
- Source
- Relationships
- PAN-DB Categorization
- WHOIS
|
| Domain | - Verdict
- Source
- Relationships
- PAN-DB Categorization
- Passive DNS
- WHOIS
|
| File | - Verdict
- Source
- Relationships
- Summary
- WildFire Analysis
- Related Sessions & Submissions
|
When investigating an indicator, you can perform actions on the indicator, such as:
| Action | Description |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enrich an indicator | You can view detailed information about the indicator (WHOIS information for example), using third-party integrations such as VirusTotal and IPinfo. For more information, see [Extract and enrich an indicator](/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md). |
| Expire an indicator | You may want to expire an indicator to filter out less relevant alerts, allowing analysts to focus on active threats. For more information, see [Expire an indicator](/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md). |
| Manage indicator relationships | Threat Intel Management in Cortex XSOAR includes a feed that brings in a collection of threat intel objects as indicators. These indicators are stored in the Cortex XSOAR threat intel library and include Malware, Attack Patterns, Campaigns, and Threat Actors. When you add or update an indicator from Unit 42 Intel, a relationship is formed in the database between the relevant threat intel object and the new, or updated, indicator. For more information, see [Manage indicator relationships](/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md). |
| Delete and exclude indicators | Indicators added to an exclusion list are disregarded by the system and are not created or involved in automated flows. For more information, see [Delete and exclude indicators](/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md). |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.