Skip to main content

Cyware Threat Intelligence eXchange

Use Update Indicators Allowed as Rule Action

Configure Update Indicators Allowed as a rule action to decide whether to take any further actions on the IOC or not.

To use Update Indicators Allowed as a rule action, do the following:

  1. In the action box, select Update Indicators Allowed from the drop-down.

  2. Select CTIX as the application as the data gets fetched from CTIX.

  3. Select an account to identify the instance to run the rule.

  4. Select from one of the following:

    • Remove: Removes the IOC from the allowed indicators list and defines that further actions may be required for the IOC.

    • Add: Adds the IOC to the allowed indicators list and defines that no further actions are required for the IOC.