Threat Intelligence: Manage and Check Indicators

What this is for

Threat intelligence is your own list of indicators of compromise (IOCs): IP addresses, network ranges, domains, URLs, email addresses and file hashes linked to attacks. Once an indicator is approved, Plenix checks your SIEM events against it automatically, and you can check any value by hand.

Plan: Enterprise.

Where to find it

Go to Monitoring → Threat Intelligence. The page shows active indicators, what's awaiting review, recent matches and matches over the last 30 days.

Adding indicators

• Add an indicator — enter the value, and either pick the type or leave it on Detect automatically. Set a severity (low, medium, high or critical), an optional expiry date and a note.
• Paste a threat report — paste the text of an advisory or email. Plenix pulls out every IP, domain, URL, email address and hash it finds, including defanged ones like evil[.]com or hxxp://. Review the list, untick anything you don't want, and click Submit for review.

Duplicates are skipped and shown as such.

Review

New indicators start as Awaiting review and aren't used for matching until an administrator approves them. On the Awaiting review tab, Approve or Reject each one with an optional review note.

Indicators are never deleted. Retire one when it's no longer relevant; it stops matching but its history is kept. Indicators with an expiry date stop matching automatically after it.

Checking a value

Use Check against feed to look up any IP, domain, URL, email address or hash. Matching covers:

• exact values;
• parent domains — mail.evil.com matches an indicator for evil.com;
• network ranges — an IP inside an indicator's range matches it.

Each match increases the indicator's Hits and updates Last hit.

SIEM correlation

Every event that reaches the SIEM integration is checked against active indicators. When there's a match, the event records which indicators matched and its severity is raised to the highest matching severity, so it stands out in your SIEM view and alerting.

Audit trail

The Audit trail tab records every submission, edit, review, retirement and match, with who did it and when. Filter by action and use Export CSV as evidence for audits.

Who can do what

• Anyone with access to the module can view indicators, submit them and run checks.
• Admins and managers can edit and retire indicators and export the audit trail.
• Only admins can approve or reject.

Where to go next

• SIEM Integration
• Dark Web Monitoring