Importing Objects

You can import a properly formatted CSV or Structured Threat Information Expression (STIX) file to add suspicious objects.

Note:

If you want to import a STIX file, pay attention to the following:

  • STIX 2.0 and 2.1 are supported.

  • By default, only objects labeled as malicious-activity and attribution, and not revoked, will be added to the Suspicious Objects List. To add additional labels, click the Default Settings icon () on the home screen.

  • Only simple indicators whose pattern contains a single object are supported.

  1. Go to Threat Intelligence > Suspicious Object Management.

    The Suspicious Object Management screen appears with the Suspicious Object List tab displayed.

  2. Click Add.

    The Add Suspicious Object screen appears.

  3. Select any of the following from the Method drop-down list:

    • CSV file: Click Select File... to locate a CSV file to import.

      Tip:

      Click Download sample CSV to obtain a properly formatted example CSV file. Populate the file with properly-formatted objects and import the file.

    • STIX file: Click Select File... to locate a STIX file from a trusted external source to import.

    Note:

    For each file you import, the maximum size allowed is 1 MB, and the maximum length allowed is 2,000 lines.

  4. Select a risk level for the imported objects.
  5. Specify the actions that connected products apply after detecting different types of objects.

    For more information, see Suspicious Object Actions.

  6. Select an expiration option.

    • Set the objects to automatically expire in a specified number of days.

    • Set the objects to never expire.

  7. (Optional) Type a description.
  8. Click Submit.

    Trend Vision One uploads the selected file, extracts suspicious domain, file SHA-1, file SHA-256, IP address, sender address, and URL objects from the file, and adds them to the Suspicious Objects List.

    The connected products receive the new object information from Trend Vision One during the next synchronization.

Parent topic: Suspicious Object List