Share observables from Threat Intelligence

Observables can be shared from Threat Intelligence to members in your trusted circle.

Before you begin

Threat Intelligence must be activated.

Role required: sn_ti.analyst

Procedure

  1. Navigate to Threat Intelligence > Ioc Repository > Observables.
  2. Select the check boxes for observables you want to share to your trusted security circle.
  3. From the Actions on selected rows drop-down list, select Share observable.
    Note:

    If you select a single observable for sharing, and it has the Enrichment: Whitelist tag, the Share observable option is not available as whitelisted observables cannot be shared. If you selected multiple observables for sharing, and one or more of them have the Enrichment: Whitelist tag, the Share observable option is available, but the whitelisted observables are excluded.

    The Observable Share dialog box appears.
    Share Observable dialog box
  4. Enter a Name for this threat share record.
  5. Enter a Description of the observables to share.
  6. Choose Circles to share the observables with.
  7. Click Submit.
    The observables are shared with the specified Trusted Circle.