- Advanced Analytics
- Understand the Basics of Advanced Analytics
- Configure Log Management
- Set Up Admin Operations
- Set Up Authentication and Access Control
- Additional Configurations
- Configure Rules
- Exabeam Threat Intelligence Service
- Threat Intelligence Service Prerequisites
- View Threat Intelligence Feeds
- Threat Intelligence Context Tables
- View Threat Intelligence Context Tables
- Assign a Threat Intelligence Feed to a New Context Table
- Create a New Context Table from a Threat Intelligence Feed
- Check ExaCloud Connector Service Health Status
- Exabeam Cloud Telemetry Service
- Manage Security Content in Advanced Analytics
- Health Status Page
Assign a Threat Intelligence Feed to a New Context Table
Some threat intelligence feeds are pre-assigned to specific context tables. However, you can easily add, remove, or change feed assignments. You can configure feed assignments in one of two ways, individually or in bulk.
Note
You cannot unassign default context table mappings.
Individual Feed Assignment
To change the assignment of a single threat intelligence feed to one or more context tables:
Navigate to the Threat Intelligence Feeds page, as described in View Threat Intelligence Feeds.
Find the feed whose context table assignments you want to change and, in the Status column, click edit
. A list of the available context tables opens.
Use the check boxes on the left of each context table to assign or unassign the threat intelligence feed. A single feed can be assigned or unassigned to multiple context tables.
To view the existing threat indicators in a specific context table, click view
. A new window opens and displays a list of keys and values for the indicators included in the context table. Click OK to close the window.When you've finished assigning or unassigning the feed to specific context tables, click Apply to save the updated assignments.
Bulk Feed Assignment
To change the assignment of multiple threat intelligence feeds to one or more context tables:
Navigate to the Threat Intelligence Feeds page, as described in View Threat Intelligence Feeds.
Use the check boxes on the left of each feed to select multiple feeds whose assignment you want to change.
At the top of the feeds list, click Assign or Unassign, depending on what changes you want to make.
Assign: A list of the available context tables opens in a new window. Use the check boxes on the left to select context tables. To see the indicators included in each table, click view
. When you've completed your table selections, click Assign. All of the specified feeds will be assigned to the selected context tables.Unassign: All of the specified feeds will be unassigned from their context tables.