To narrow down IOC search results for faster, more powerful investigations, you can filter IOCs in List View by any or all of the following means:
- Enclave (data sources)
- MITRE ATT&CK
- IOC type
For any of these options, use the arrows on the top right corner of a section to expand or hide that section. To select all items in a section, click Select All. To select individual items, click on the item and you will see a checkmark appear to the right, indicated it is now a selected item.
Filtering by Enclave
You can filter IOCs by data sources:
- My Enclaves
- Premium Intel enclaves that you have subscribed to.
- Open Source enclaves that you have subscribed to
- Intel researchers who you have subscribed to.
Filtering by Tags
You can filter by tags to quickly remove IOCs that don't fit the profile of your investigation. For example, you may want to filter out most terms but keep just a few critical ones, as in this example.
Filtering by MITRE ATT&CK
You can use the MITRE ATT&CK terms to filter IOCs. MITRE ATT&CK is an open-source knowledge base of adversary tactics and techniques based on real-world observations.
Filtering by Date
You can filter by a range of dates, including 1 day, 7 days, 1 month, 6 months, or Max (all dates available).
Filtering by IOC Type
You can select which types of IOC to show in the List view using the IOC Type sub-panel.