> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md). # What is Threat Intel Management? The Cortex XSOAR native threat intel management capabilities allow you to unify the core components of threat intel, including threat intel aggregation, scoring, and sharing. Cortex XSOAR automates threat intel management by ingesting and processing indicator sources, such as feeds and lists, and exporting the enriched intelligence data to SIEMs, firewalls, and any other system that can benefit from the data. These capabilities enable you to sort through millions of indicators daily and take automated steps to make those indicators actionable. {% hint style="info" %} ### Note Although some features are available without a TIM license such as indicator customization, you must have the Cortex XSOAR Threat Intel Management (TIM) license to use the TIM features. {% endhint %} **Why Threat Intel Management?** * Powerful native centralized threat intel Supercharge investigations with instant access to a large repository of built-in, high-fidelity Palo Alto Networks threat intelligence crowdsourced from the largest footprint of network, endpoint, and cloud intel sources. * Indicator relationships Indicator connections enable structured relationships between threat intelligence sources and incidents. These relationships surface important context for security analysts on new threat actors and attack techniques. * Hands-free automated playbooks with extensible integrations Take automated action to shut down threats across over 600 third-party products with purpose-built playbooks based on proven SOAR capabilities. * Granular indicator scoring and management Take charge of your threat intel with playbook-based indicator lifecycle management and transparent scoring that can be easily extended and customized. * Automated, multi-source feed aggregation Eliminate manual tasks with automated playbooks to aggregate, parse, prioritize, and distribute relevant indicators in real-time to security controls for continuous protection * Most comprehensive marketplace The largest community of integrations with content packs that are prebuilt bundles of integrations, playbooks, dashboards, field subscription services, and all the dependencies needed to support specific security orchestration use cases. **Threat Intel with Security orchestration** Security orchestration, automation, and response (SOAR) solutions have been developed to weave threat intelligence management into workflows by combining TIM capabilities with incident management, orchestration, and automation capabilities. SOAR solutions weave threat intelligence into a more unified and automated workflow. It matches alerts both to their sources and to compiled threat intelligence data and can automatically execute an appropriate response. As part of the extensible Cortex XSOAR platform, TIM unifies threat intelligence aggregation, scoring, and sharing with playbook-driven automation. It empowers security leaders with instant clarity into high-priority threats to drive the right response across the entire enterprise. Cortex XSOAR provides a common platform for incidents and threat information, where there is no disconnect between external threat data and your environment. Automated data enrichment of indicators provides analysts with relevant threat data to make smarter decisions. Integrated case management allows for real-time collaboration, boosts operational efficiencies across teams, and automates playbooks to speed response across security use cases. ![TIM-Architecture.png](/files/J8N8xfFyZpIroiiiog2j) Cortex XSOAR collects data from sources such as incidents, Unit 42, and external threat intel feeds. After the data is ingested, Threat Intel playbooks examine the data proactively. The data gets deduped, normalized, and stored in the Threat Intel database so that a Threat Intel analyst can start a threat analysis. The analyst can then send that information to firewalls, share it with other stakeholders, and take remedial action as necessary. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.