Managing Threat Intelligence (Indicator) Types

Scenarios

This section describes how to manage threat indicator types.

• Viewing Threat Intelligence Types: describes how to view existing indicator types and their details.
• Adding a Threat Intelligence Type: describes how to create custom indicator types.
• Associating a Threat Intelligence Type with a Layout: describes how to associate a custom indicator type with an existing layout.
• Editing a Threat Intelligence Type: describes how to edit a custom indicator type.
• Managing a Threat Intelligence Type: describes how to enable, disable, and delete a custom indicator type.

Limitations and Constraints

• By default, built-in indicator types are associated with existing layouts. You cannot customize associated layouts.
• Built-in indicator types are enabled by default and cannot be edited, enabled, disabled, or deleted.
• After a user-defined threat indicator type is added, the type ID cannot be modified.

Viewing Threat Intelligence Types

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 1 Type Management page
   

5. On the Type Management page, click the Threat Intelligence tab.
6. On the Threat Intelligence page, view details. For details about the parameters, see Table 1.

   Table 1 Threat intelligence (indicator) type parameters

   Parameter	Description
   Type Name/Type Tag	Name and type tag of threat indicator
   Associated Layout	Layout associated with threat indicator
   Startup Status	Indicates the enabling status of a threat indicator type: Enabled: The current type has been enabled. Disabled: The current type has been disabled.
   Expired Time	Expiration time of threat indicator.
   Built-in	Indicates whether the indicator was built in the system.
   Description	Description of an indicator
   Operation	You can edit and delete the indicator.

Adding a Threat Intelligence Type

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 2 Type Management page
   

5. On the Type Management page, click the Threat Intelligence tab.
6. On the Threat Intelligence page, click Add. On the Add Threat Intelligence slide-out panel, set type parameters.

   Table 2 Indicator type parameters

   Parameter	Description
   Type Name	Name of the indicator to be added.
   Type Tag	Enter the indicator type ID. The keyword must comply with the upper camel case naming rules, for example, TypeTag.
   Startup Status	Set the enabling status of an indicator.
   Expired Time	Set the expiration time of the indicator. Never Expire: The current indicator type never expires. Time Interval: Set the interval for invalidating indicator.
   Description	Description of a custom indicator

   

   After a user-defined indicator type is added, the type ID cannot be modified.

7. In the lower right corner of the page, click OK.

   After the indicator type is added, you can view the new type in the table on the Indicators page.

Associating a Threat Intelligence Type with a Layout

By default, built-in indicator types are associated with existing layouts. You cannot customize associated layouts.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 3 Type Management page
   

5. On the Type Management page, click the Threat Intelligence tab.
6. On the Threat Intelligence page, select the type to be associated with a layout and click Associated Layout in the Operation column of the target type. The Associate Layout dialog box is displayed.
7. In the Associate Layout dialog box, select the target layout and click OK.

Editing a Threat Intelligence Type

• Currently, built-in indicator types cannot be edited.
• After a custom indicator type is added, the type tag cannot be edited.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 4 Type Management page
   

5. On the Type Management page, click the Threat Intelligence tab.
6. On the Threat Intelligence page, select the type to be edited and click Edit in the Operation column of the target type. The editing page is displayed on the right.
7. On the displayed page, edit the parameter information of the corresponding type.

   Table 3 Indicator type parameters

   Parameter	Description
   Type Name	Name of the user-defined threat indicator type.
   Type Tag	Indicator type ID, which cannot be modified.
   Startup Status	Set the enabling status of an indicator.
   Expired Time	Set the expiration time of the indicator. Never Expire: The current indicator type never expires. Interval: Set the interval for indicator type expiration.
   Description	Description of a custom indicator type

8. In the lower right corner of the page, click Confirm.

Managing a Threat Intelligence Type

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 5 Type Management page
   

5. On the Type Management page, click the Threat Intelligence tab.
6. On the Type Management tab, manage indicator types.
   

   • Built-in indicator types are enabled by default. You do not need to manually enable them.
   • Currently, built-in indicator types cannot be disabled or deleted.

   Table 4 Managing an indicator type

   Operation	Description
   Enable	On the Threat Intelligence page, select the types to be enabled and click Batch enable in the upper left corner of the type list. Alternatively, locate the row containing the indicator to be enabled, and click Disable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the status of the target type changes to Enable, the target type is enabled successfully.
   Disable	On the Threat Intelligence page, select the types to be disabled and click Batch Disable in the upper left corner of the type list. Alternatively, locate the row containing the indicator to be disabled, and click Enable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the Status of the target type changes to Disable, the target type is disabled successfully.
   Delete	On the Type Management tab, select the type to be deleted and click Delete in the Operation column. In the displayed dialog box, enter DELETE and click OK.