Configure Process Intel
Notice
This feature is only available in the New Layout for Incident Response.
When an incident is created, you can enable Process Intel for specific text fields of an incident to automatically process threat intel from these fields in Respond (CFTR) and send them to Intel Exchange (CTIX) for ingestion and enrichment.
If you are updating the text fields in an incident, click Process Intel and Save to update and process intel.
Note
Respond identifies private IP addresses and ensures they are neither processed in Respond nor sent to Intel Exchange.
Before You Start
You must have Create/Update permission for Form Management.
You must have enabled Process Intel in Admin > Configurations > Basic Configurations. For more information, see Configure General Settings.
Steps
To enable Process Intel for a field, follow these steps:
Go to Admin Panel > Form Management > Incident.
Click Edit corresponding to the workflow for which you want to enable Process Intel.
Hover over the text field, and click Edit.
In Field Settings, select Process Intel. By default, CFTR is selected. To send intel to Intel Exchange for ingestion and enrichment, select CTIX.
Note
CTIX option is only available if Intel Exchange is integrated and enabled in Respond. For more information, see Integrate CTIX.
Click Save.