Skip to content

Commit 2c420ba

Browse files
authored
Update docs/cse/administration/create-custom-threat-intel-source.md
1 parent f6eba8a commit 2c420ba

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

docs/cse/administration/create-custom-threat-intel-source.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,7 @@ You can set up and populate custom threat intelligence sources interactively fro
1414

1515
## How Cloud SIEM uses indicators
1616

17-
When Cloud SIEM encounters an indicator from your threat source in an incoming record it adds relevant information to the record. Because threat intelligence information is persisted within records, you can reference it downstream in both rules and search. The built-in rules that come with Cloud SIEM
18-
automatically create a signal for records that have been enriched in this way.
17+
When Cloud SIEM encounters an indicator from your threat source in an incoming record it adds relevant information to the record. Because threat intelligence information is persisted within records, you can reference it downstream in both rules and search. The built-in rules that come with Cloud SIEM automatically create a signal for records that have been enriched in this way.
1918

2019
Rule authors can also write rules that look for threat intelligence information in records. To leverage the information in a rule, you can extend your custom rule expression, or add a Rule Tuning Expression to a built-in rule. For a more detailed explanation of how to use threat intelligence information in rules, see [Threat Intelligence](/docs/cse/rules/about-cse-rules/#threat-intelligence) in the *About Cloud SIEM Rules* topic.
2120

0 commit comments

Comments
 (0)