To upload indicators for use in Helix Enterprise, you must include the indicators in a correctly formatted comma-separated value (CSV) or JSON file. An indicator file that was exported from Helix Enterprise is already in the correct format. This section explains each of the fields and provides guidelines for the maximum number of indicators.
The first line of the uploaded file determines the property names of each field for the remainder of the file. The names must include value, notes, risk, and type, in any order.
Note
Each subsequent line must follow the order specified by the first line.
Value: The actual indicator, which can include: an email address, an IPv4 address, a Fully-Qualified Domain Name, SHA1, or an md5 hash.
Notes: Any notes that you would like to appear alongside the indicator in Helix Enterprise. Notes can include up to 255 characters.
Risk: The level of risk that you assign to this indicator: Low, Medium, High, or Critical. The first letter of the assigned risk level must be capitalized.
Type: The type of indicator specified in the Indicator field. Only the following indicator types can be used: ipv4, sha1, fqdn, or md5. All types must be lowercase.
For best results, wrap each field in quotation marks. For example:
"supermalwarez4u.com", “verified evil site", "Low", "fqdn"
The notes field is optional. If you choose not to use it, leave the field blank. For example:
"supermalwarez4u.com", ,"Low","fqdn"
Here is an example of a custom indicator:
value,notes,risk,type
Followed by:
"supermalwarez4u.com", "verified evil site", "Low", "fqdn"
"5815b13044fc9248bf7c2dba771f0e6496d9e536", "Conficker", "Critical", "sha1"
When Helix Enterprise receives your custom indicators, it will populate each line with the following fields:
_createdBy: The user who created the custom indicator.
_updatedBy: The user who most recently updated this custom indicator.
createDate: The date the original custom indicator was uploaded to Helix Enterprise.
id: The ID assigned to the custom indicator.
updateDate: The date of the last update to this custom indicator.
Each Helix Enterprise instance can include a maximum of 400,000 custom indicators of compromise.
If you use the bulk file upload option, the file size can be a maximum of 7 MB. Each list can have a maximum of 28,000 indicators. To use more than 28,000 indicators, import multiple lists.