Watchlist
A Watchlist is any keyword that you can monitor within the intel received in Intel Exchange. Keywords can include IP addresses, hashes, domains, URLs, technical terms, non-technical terms, or any word or number.
Adding a keyword to the Watchlist enables you to:
Track the number of times a keyword appears in Intel Exchange from various sources.
View each occurrence of the keyword and the sources reporting it.
Receive system notifications whenever a watchlist keyword is observed, and enable email alerts for important keywords.
Apply one or more tags automatically to matched intel. If multiple watchlist keywords match the same intel, all corresponding tags are applied.
Monitor keywords in titles, descriptions, indicator patterns, custom attributes (key: value pairs), and tags.
Notice
The tagging capability and extended field matching (custom attributes and tags) for Watchlist are available in Intel Exchange v3.7.5.3 onwards.
Note
Read-only users do not have permission to add or remove keywords from the watchlist.