Manage Threat Intel
To view the list of threat intel records, go to Menu > Threat Intel. By default, you can view the Threat Intel records of the type IP on the listing page. To view the list of threat intel records of a specific type, use Quick Filters. You can also use the search bar for a specific threat intel or use the predefined filters to filter the list of threat intel records.
You can filter the list using the following filters:
Status
TLP
Type
First Sighted Date
Labels
You can also view the details of indicators retrieved from Intel Exchange by hovering over the indicator and clicking View Details. For more information, see Connect the Dots.
Note
This feature is available from Respond v3.4.2 onwards.
Customize Threat Intel Table
You can customize the columns of the Threat Intel listing table to view only relevant columns. In addition to the default columns, you can add up to 15 custom fields from the list of Custom Fields.
To customize the table columns, follow these steps:
On the Threat Intel listing table, click Customize Table and select the fields to add to the listing page.
In Default Fields, select the default fields you want to add as columns on the listing page.
In Custom Fields, select the custom fields you want to add as columns on the listing page. This feature is available in Respond v3.4.4 onwards. You can add up to 15 custom fields to the table.
Click Save.
For more information on compliance, search, filters, saved searches, sorting, activity logs, and exporting Threat Intel details, see Manage Module Listings.