Indicators
Threat intel in the console holds indicators: IP addresses, domains, URLs and file hashes (MD5, SHA-1, SHA-256), each with a severity, source, organization scope and tags. Add them by pasting a list, one per line, or subscribe to a feed with an Indicator feed integration in Settings › Integrations.
Matching
- Continuously. New events are compared against the active indicators as they arrive. An indicator-match rule turns a hit into an alert.
- Retro-hunt. When a new indicator is added, earlier events in retention are searched for it too. An indicator published today meets last week's logs.
Enrichment
In playbooks, XenXDR can look up reputation for an alert's entities: VirusTotal for file hashes, AbuseIPDB for IP addresses, and Spur for whether an IP address is a VPN, proxy or Tor exit, a residential proxy or a datacenter. Only public IP addresses are looked up. The event graph also links to these services. Enrichment is off until you add a VirusTotal, AbuseIPDB or Spur integration with its API key or token in Settings › Integrations. The values sent to those services can in some cases be personal data; the subprocessors page lists them for that reason.
Rule interaction
Indicator matches respect suppressions and exceptions like any other detection. Indicators can carry an expiry so that a stale list stops firing.