> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md). # Indicator classification and mapping The following table shows methods by which indicators are detected and ingested in Cortex XSOAR and how they are classified and mapped. | Method | Description | Classification and Mapping | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Integration | Feed integrations: Fetch indicators from a feed, for example, TAXII, Office 365, and Unit 42. |

Indicator classification and mapping is done in the integration code by duplicating the integration in Integrations → Instances and not in the Indicators → Classification & Mapping tab. For more information, see Feed Integrations.

Some integrations come with a classifier and mapper, which you can customize.

| | Indicator extraction | Indicators are extracted from selected incidents that flow into Cortex XSOAR, for example from an SIEM integration. |

Only the value of an indicator is extracted, so no classification or mapping is needed.

For more information, see Indicator extraction.

| | Manual | |

Data is inserted manually via the UI so no classification or mapping is needed.

If importing an STIX file, mapping is done via the STIX parser code.

| **Classify and map an indicator type for an integration** The indicator classification and mapping feature enables you to take the data that Cortex XSOAR ingests from integrations, and classify and map the data to indicator types and indicator fields. By classifying the data as different indicator types, you can process them with different playbooks suited to their respective requirements. {% hint style="info" %} ### Note When creating a new indicator type, you classify and map the indicator fields in the indicator type settings. For more details, see [Map custom indicator fields](/cortex-xsoar-8-on-prem/8.5/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/map-custom-indicator-fields.md). {% endhint %} Classification determines the type of indicator that is created for data ingested from a specific integration. You create a classifier and define that classifier in an integration. You can map the fields from your third-party integration to the fields in your indicator layouts as follows: * Map your fields to indicator types irrespective of the integration or classifier. This means that you can create a mapping before defining an instance and ingesting indicators. By doing so, when you do define an instance and apply a mapper, the data that comes in is already mapped. * Create default mapping for all of the fields that are common to all indicator types, and then map only those fields that are specific to each alert type individually. You can still overwrite the contents of a field in the specific indicator type.
Classify an indicator type When an integration fetches indicators, it populates the raw JSON object for the indicator. The raw JSON object contains all of the attributes (fields) for an indicator. For example, source, when the event was created, the priority that was designated by the integration, and more. When classifying ingested indicator data, you want to select an attribute (field) that can determine the indicator type. Use this procedure to create a classifier or duplicate an existing classifier for ingested indicator data. 1. Select Settings & Info → **Settings** → **Object Setup** → **Indicators** → **Classification & Mapping**. 2. Do one of the following: 1. To create a new classifier, select + New → **Indicator Classifier**. 2. To edit an existing classifier, select it and click **Edit**. If the classifier is installed from a content pack, you need to duplicate and then edit. 3. Under **Get data**, select from where you want to import the indicator data. You will classify the indicator type based on this information.

Note

You can optionally skip importing data. Click the pencil on the right of each indicator type on the right pane to enter the value manually.

* **Pull from instance:** Select an existing integration instance to import indicator data from. * **Upload JSON:** Upload a formatted JSON file that includes the fields you want to classify by. 4. Under **Fetched data**, select from the attributes (fields) in the imported indicator object a field that will serve as the classifier (key) to route to a specific indicator type. Cortex XSOAR searches through the imported indicator objects for the values for the field you select. 5. Drag the found values from the **Unmapped Values** column to the relevant indicator type on the right pane. 6. **Save** the classifier. 7. Apply the indicator classifier to the relevant feed integration. 1. Go to Settings & Info → **Settings** → **Integrations** → **Instances**. 2. Select an existing integration instance you want to apply the indicator classifier to or create a new integration instance. 3. In the integration instance settings under **Classifier**, select the classifier you created and click **Save**.
Map indicator fields Mappers enable you to map the information from ingested indicator data to the indicator fields that you have in your system. Mapping data takes place in two stages: 1. Map all of the fields that are common to all indicators in the default mapping. 2. Map the additional fields that are specific for each indicator type, or overwrite the mapping that you used in the default mapping. {% hint style="info" %} ### Note In the **Classification & Mapping** page, the mapping does not indicate for which indicator types they are configured. When creating a mapper, it is best practice to add to the mapper name and the indicator type the mapper is for. For example, Mail Listener - Phishing. When mapping a list, we recommend you map to a multi-select field. Short text fields do not support lists. If you need to map a list to a short text field, add a transformer in the relevant playbook task to split the data back into a list. {% endhint %} Use this procedure to create a mapper or duplicate an existing mapper to map all of the ingested indicator fields to an indicator layout. 1. Select Settings & Info → **Settings** → **Object Setup** → **Indicators** → **Classification & Mapping**. 2. Do one of the following: 1. To create a new mapper, select + New → **Indicator Mapper (incoming)**. 2. To edit an existing mapper, select it and click **Edit**. If the mapper is installed from a content pack, you need to duplicate and then edit. 3. Under **Get data**, select from where you want to import the indicator data. You will map the indicator data based on this information. * **Pull from instance:** Select an existing integration instance to import indicator data from. * **Upload JSON:** Upload a formatted JSON file that includes the fields you want to map. 4. Under **Indicator Type**, start by mapping out the **Common Mapping**. This mapping includes the fields that are common to all of the indicator types and saves you time having to define these fields individually in each indicator type. 5. Click the attribute (field) to which you want to map. You can further manipulate the field using filters and transformers. 6. Repeat this process for the other indicator types for which this mapping is relevant. 7. **Save** the mapper. 8. Apply the indicator mapper to the relevant feed integration. 1. Go to Settings & Info → **Settings** → **Integrations** → **Instances**. 2. Select an existing integration instance you want to apply the classifier to or create a new integration instance. 3. In the integration instance settings under **Mapper**, select the mapper you created and click **Save**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.