--- title: "Importing Potential Indicators Found With Intelligence Anywhere" slug: "importing-potential-indicators-found-with-threatconnect-intelligence-anywhere" description: "This article describes how to import potential Indicators found during a ThreatConnect Intelligence Anywhere scan into your ThreatConnect instance." tags: ["Importing Data", "Analytical Tools"] updated: 2023-08-28T15:57:24Z published: 2023-08-28T15:57:24Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Importing Potential Indicators Found With ThreatConnect Intelligence Anywhere With ThreatConnect® Intelligence Anywhere, you can import potential Indicators found during a scan into ThreatConnect and associate them to a new or existing Group. ## Importing Indicators into an Existing Group 1. Add a potential Indicator to the batch import list by****selecting its checkbox in the [**Scan Results**window](https://knowledge.threatconnect.com/docs/reviewing-threatconnect-intelligence-anywhere-scan-results) or clicking the **Add to batch import list**button in its [**Details** window](https://knowledge.threatconnect.com/docs/reviewing-threatconnect-intelligence-anywhere-scan-results#viewing-results-on-the-scanned-resource). To add all known or unknown****Indicators to the batch import list, select the **Select All**checkbox on the **Known Indicators**or **Unknown Indicators**tab, respectively, of the **Scan Results**window. 2. Once all desired potential Indicators are added to the batch import list, click the **Batch import selected indicators**button on the **Scan Results** window (Figure 1).![Graphical user interface, website Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%201.png) 3. The **Batch Import**window will be displayed (Figure 2). Select **Add all selected indicators to an already existing group**.![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%202.png) 4. Click the **Import to ThreatConnect**button. A new tab will open in your browser displaying the **Select Group** section of the **Import to Existing Group**screen in ThreatConnect (Figure 3).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%203.png) - Select the Group to which the selected potential Indicator(s) will be associated. To search for a Group, enter its name in the search bar above the table containing all Groups. - To view a Group’s **[](https://knowledge.threatconnect.com/docs/the-details-screen)** [](https://knowledge.threatconnect.com/docs/the-details-screen)[**Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen) [](https://knowledge.threatconnect.com/docs/the-details-screen)**[](https://knowledge.threatconnect.com/docs/the-details-screen)**, click the **Open in New Tab**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Open%20in%20New%20Tab%20icon.png)icon to the right of the **Owner**column. - Click the **Next** button. 5. The **Associations**section will be displayed (Figure 4).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%204.png) NoteSelected Indicators that were categorized as known in the [**Scan Results**window](https://knowledge.threatconnect.com/docs/reviewing-threatconnect-intelligence-anywhere-scan-results) may be labeled as unknown on the **Associations** section if they are unknown to the owner of the Group into which they are being imported. - **Associations**: The selected potential Indicators will be displayed in the **Associations**card. In this card, you can complete the following actions: - **Private**: To mark an Indicator as [private](/v1/docs/private-indicators), select the corresponding checkbox in the **Private** column. This column will be displayed only if your System Administrator has enabled private Indicators. - **Actions**: To remove a potential Indicator from the list of Indicators being imported into ThreatConnect, click **Delete**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/importing-potential-indicators-into-threatconnect-image-m43u6fj8.png). - **Association Details**: In the **Associations Details**card, you can fill out the following information, which will be applied to all Indicators being imported and associated to the Group: - **Description:** Enter a [Description](https://knowledge.threatconnect.com/docs/the-description-attribute) for the Indicator(s). - **Tags:** Enter [Tags](https://knowledge.threatconnect.com/v1/docs/applying-tags) to apply to the Indicator(s). By default, a **Source: Browser Extension** Tag will be applied to all selected potential Indicators. However, you can remove this Tag, if desired. - **Threat Rating**: Use the skull icons to set the [Threat Rating](https://knowledge.threatconnect.com/v1/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s). - **Confidence Rating**: Use the slider to set the [Confidence Rating](https://knowledge.threatconnect.com/v1/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s). - Click the **Save******button. The selected potential Indicator(s) will be imported into ThreatConnect and associated to the Group, and the Group’s **[](https://knowledge.threatconnect.com/docs/the-details-screen)** [](https://knowledge.threatconnect.com/docs/the-details-screen)[**Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen) [](https://knowledge.threatconnect.com/docs/the-details-screen)**[](https://knowledge.threatconnect.com/docs/the-details-screen)** will be displayed. The Indicators imported into ThreatConnect will be displayed on **[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)**[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)[**Indicators**card](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)**[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)** of the Group’s **[](https://knowledge.threatconnect.com/docs/the-associations-tab)**[](https://knowledge.threatconnect.com/docs/the-associations-tab)[**Associations**tab](https://knowledge.threatconnect.com/docs/the-associations-tab)[](https://knowledge.threatconnect.com/docs/the-associations-tab)**[](https://knowledge.threatconnect.com/docs/the-associations-tab)**. You may also view these associations on the [**Associations** card](https://knowledge.threatconnect.com/v1/docs/the-associations-card) of the Group’s [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy), under the [**Associated Indicators** section](https://knowledge.threatconnect.com/v1/docs/table-view-associated-indicators) when the card is in table view. ## Importing Indicators into a New Group 1. Follow Steps 1 and 2 in the [“Importing Indicators into an Existing Group”](/docs/importing-potential-indicators-found-with-threatconnect-intelligence-anywhere#importing-indicators-into-an-existing-group) section. 2. On the **Batch Import** window (Figure 2), select **Create a new group with all selected indicators**. 3. Click****the **Import to ThreatConnect**button. A new tab will open in your browser with the **Details** section of the **Create**screen for Groups in ThreatConnect displayed (Figure 5).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%205.png) - **Type**: By default, **Event**is selected. If desired, select another [Group type](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model) from the dropdown. - Complete all fields on the **Details**section. For descriptions of each field available on this screen, see the [“Creating a Group” section of *Create*](https://knowledge.threatconnect.com/v1/docs/create#creating-a-group). - Click the **Next**button.NoteThe **Save** button is available only on the **Associations** and **Attachments** sections. 4. The **Associations**section will be displayed (Figure 6).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%206.png) NoteSelected Indicators that were categorized as known in the [**Scan Results**window](https://knowledge.threatconnect.com/docs/reviewing-threatconnect-intelligence-anywhere-scan-results) may be labeled as unknown on the **Associations** section if they are unknown to the owner of the Group into which they are being imported. - **Associations**: The selected potential Indicators will be displayed in the **Associations**card. In this card, you can complete the following actions: - **Private**: To mark an Indicator as [private](/v1/docs/private-indicators), select the corresponding checkbox in the **Private** column. This column will be displayed only if your System Administrator has enabled private Indicators. - **Actions**: To remove a potential Indicator from the list of Indicators being imported into ThreatConnect, click **Delete**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/importing-potential-indicators-into-threatconnect-image-m43u6fj8.png). - **Association Details**: In the **Associations Details**card, you can fill out the following information, which will be applied to all Indicators being imported and associated to the Group: - **Description:** Enter a [Description](https://knowledge.threatconnect.com/docs/the-description-attribute) for the Indicator(s). - **Tags:** Enter [Tags](https://knowledge.threatconnect.com/v1/docs/applying-tags) to apply to the Indicator(s). By default, a **Source: Browser Extension** Tag will be applied to all selected potential Indicators. However, you can remove this Tag, if desired. - **Threat Rating**: Use the skull icons to set the [Threat Rating](https://knowledge.threatconnect.com/v1/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s). - **Confidence Rating**: Use the slider to set the [Confidence Rating](https://knowledge.threatconnect.com/v1/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s). - Click the **Next******button. 5. The **Attachments**section will be displayed (Figure 7). **Attachments**is an optional section where you can attach related files to the Group.![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Importing%20Potential%20Indicators%20into%20ThreatConnect_Figure%207.png) - Upload files for which Document Groups will be created and associated to the Group being created, if desired. After each file is uploaded, the filename will be displayed below the upload area, along with a checkbox labeled **Add to Malware Vault**. Leave this checkbox cleared unless you are [uploading a malware file](https://knowledge.threatconnect.com/docs/uploading-malware). - Click the **Save** button. The selected potential Indicator(s) will be imported into ThreatConnect and associated to the newly created Group, and the Group’s **[](https://knowledge.threatconnect.com/docs/the-details-screen)** [](https://knowledge.threatconnect.com/docs/the-details-screen)[**Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen) [](https://knowledge.threatconnect.com/docs/the-details-screen)**[](https://knowledge.threatconnect.com/docs/the-details-screen)** will be displayed. The Indicators imported into ThreatConnect will be displayed on **[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)**[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)[**Indicators**card](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)**[](https://knowledge.threatconnect.com/docs/the-associations-tab#indicators)** of the Group’s **[](https://knowledge.threatconnect.com/docs/the-associations-tab)**[](https://knowledge.threatconnect.com/docs/the-associations-tab)[**Associations**tab](https://knowledge.threatconnect.com/docs/the-associations-tab)[](https://knowledge.threatconnect.com/docs/the-associations-tab)**[](https://knowledge.threatconnect.com/docs/the-associations-tab)**. You may also view these associations on the [**Associations** card](https://knowledge.threatconnect.com/v1/docs/the-associations-card) of the Group’s [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy), under the [**Associated Indicators** section](https://knowledge.threatconnect.com/v1/docs/table-view-associated-indicators) when the card is in table view. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20107-07 v.05.A