Create Intel in CTIX
Analysts can gather threat intelligence from various sources and also build their own intelligence in the form of STIX packages and share them with subscribers. As an analyst, you can manually ingest intel in CTIX in one of the following ways:
Quick Add Intel: When you have to add a few threat data objects with specific intel into CTIX, use Quick Add Intel. For example, use quick add intel when you want to manually add a few indicators, malware, and so on with bare minimum details into CTIX.
Import Intel into Intel Exchange: When you have to upload large amounts of data from various file formats use, Import Intel. For example, use import intel when you want to upload intel from a MISP format file.
Submit Detailed Intel: When you want to manually create intel with specific details, use Detailed Submission. For example, use detailed submission when you want to include basic details, custom attributes, create relations, add sightings, and add STIX attributes to your intel in CTIX.
Third-Party Integration: When you want to receive threat intel from a third-party platform to the CTIX platform, you can integrate the CTIX app into a third-party platform. For example, you can integrate the CTIX app into the Slack platform, to receive IOCs from Slack and create intel.
Browser Extension: When you want to scan an external web page to detect and extract threat data objects to create intel in the CTIX platform, you can configure the Cyware Threat Intel Crawler browser extension.
Note
Read-only users do not have permission to create or update intel in CTIX.