Create Intel in Intel Exchange
Analysts can gather threat intelligence from various sources and also build their own intelligence in the form of STIX packages and share them with subscribers. As an analyst, you can manually ingest intel in Intel Exchange in one of the following ways:
Quick Add Intel: When you have to add a few threat data objects with specific intel into Intel Exchange, use Quick Add Intel. For example, use quick add intel when you want to manually add a few indicators, malware, and so on, with the bare minimum details into Intel Exchange.
Import Intel into Intel Exchange: When you have to upload large amounts of data from various file formats, use Import Intel. For example, use import intel when you want to upload intel from a MISP format file.
Detailed Submission: When you want to manually create intel with specific details, use Detailed Submission. For example, use a detailed submission when you want to include basic details, custom attributes, create relations, add sightings, and add STIX attributes to your intel in Intel Exchange.
Third-Party Integration: When you want to receive threat intel from a third-party platform to the Intel Exchange platform, you can integrate the Intel Exchange app into a third-party platform. For example, you can integrate the Intel Exchange app into the Slack platform to receive IOCs from Slack and create intel.
Browser Extension: When you want to scan an external web page to detect and extract threat data objects to create intel in the Intel Exchange platform, you can configure the Cyware Threat Intel Crawler browser extension.
Note
Read-only users do not have permission to create or update intel in Intel Exchange.