Alert Observables

​

Overview

​

Observable Types

​

Network Indicators

• IP Addresses
• Domain Names
• URLs
• Email Addresses
• Network Services

​

File Indicators

• File Hashes (MD5, SHA1, SHA256)
• File Names
• File Paths
• File Types

​

System Indicators

• Registry Keys
• Process Names
• System Commands
• User Accounts

​

Custom Indicators

• Custom Observable Types
• Organization-specific Indicators
• Industry-specific Artifacts

​

Managing Observables

​

Adding Observables

1. Click “Add Observable” button
2. Select observable type
3. Enter observable value
4. Add optional description
5. Set TLP/PAP levels if applicable

​

Bulk Operations

• Import multiple observables
• Export observable list
• Bulk update TLP/PAP
• Bulk delete observables

​

Observable Properties

• Type classification
• Value
• Description
• TLP (Traffic Light Protocol) level
• PAP (Permissible Actions Protocol) level
• First/Last seen timestamps
• Source information

​

Observable Enrichment

​

Automatic Enrichment

• Reputation data
• Geolocation information
• WHOIS data
• Historical context
• Related indicators

​

Manual Analysis

• Add analysis notes
• Link to external sources
• Document investigation findings
• Tag related observables

​

Visualization

​

List View

• Sortable columns
• Quick filters
• Type indicators
• Enrichment status

​

Relationship View

• Observable connections
• Related alerts
• Common patterns
• Timeline visualization

​

Best Practices

1. Data Quality
   • Validate observable format
   • Remove false positives
   • Document context
   • Maintain consistent format
2. Enrichment
   • Review enrichment data
   • Update stale information
   • Document findings
   • Link related data
3. Organization
   • Use consistent naming
   • Group related observables
   • Tag effectively
   • Document relationships

​

Next Steps