--- title: "Signature Import Knowledge Base Article | ThreatConnect" slug: "signature-import" description: "This article demonstrates how to import a Signature Group into ThreatConnect." tags: ["Getting Started", "Importing Data"] updated: 2024-01-18T03:53:06Z published: 2024-01-18T03:53:06Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Signature Import ## Overview ThreatConnect® allows you to import the following types of signature files as a Signature Group object: Bro, ClamAV®, CybOX™, Iris® Search Hash, Microsoft® Kusto Query Language (KQL), OpenIOC, Regex, Splunk® Search Processing Language (SPL), Sigma, Snort®, STIX™ Pattern, Suricata, [ThreatConnect Query Language (TQL)](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql) Query, and YARA. Once you have imported a Signature, you can [associate](https://knowledge.threatconnect.com/docs/associations) it to [Groups](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#groups), [Indicators](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicators), [Intelligence Requirements (IRs)](https://knowledge.threatconnect.com/docs/intelligence-requirements), and Victims. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | A signature file | ## Importing a Signature 1. On the top navigation bar, hover the cursor over **Import** and select **Signature**. The **Import Signature** screen will be displayed (Figure 1). ![Figure%201_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Signature%20Import_7.4.0.png) - **Owner**: Select an [owner](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) (i.e., Organization, Community, or Source) into which the signature file will be imported as a Signature Group. - **Type**: Select a signature type. - **+** **IMPORT FILE**: Click this button to locate and select a file containing the signature file to upload. 2. After a file has been uploaded, a **File**box containing the uploaded file’s contents will be displayed (Figure 2). ![Figure%202_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Signature%20Import_7.4.0.png) - Review the file’s contents, if desired. Note that you cannot edit the text displayed in the **File**box. - Click the **Next** button. 3. The **Confirm** screen will be displayed (Figure 3). ![Figure%203_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Signature%20Import_7.4.0.png) - **File Name**: This field is auto-populated with the name of the file selected on the **Import**screen. Click in the box to edit the file name, if desired. - **Signature Name**: Enter the name for the Signature Group object being created. - **Description**: Enter a [Description](https://knowledge.threatconnect.com/docs/the-description-attribute) for the Signature. - **Source**: Enter a [Source](https://knowledge.threatconnect.com/docs/sourcing-data)for the Signature.NoteEntering a Description and Source is optional, but highly recommended to provide as much metadata as possible. - Click the **Next** button. 4. The **Save** screen will be displayed (Figure 4). ![Figure%204_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Signature%20Import_7.4.0.png) - **+ NEW ASSOCIATION**: Click this button to [associate](https://knowledge.threatconnect.com/docs/associations)the Signature to Groups, Indicators, IRs, and Victims in your owners.NoteIf you do not want to create any associations at this time, click the **SAVE** button to complete the import process. 5. Click the **+ NEW ASSOCIATION** button to display the **Select an Association** window (Figure 5). ![Figure%205_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Signature%20Import_7.4.0.png) 6. Select the type of object to associate to the Signature from the **Select Type** dropdown. The window will display all objects of that type (Figure 6). ![Figure%206_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Signature%20Import_7.4.0.png) - **Filter**: If desired, enter a search term in this****field and click the **magnifying glass** ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/signature-import-image-f8hhcq0c.png) to narrow the results. - Select the checkbox for each object to associate to the Signature. - Click the **SAVE**button.ImportantWhen associating objects to a Signature, you can only associate objects of a single object type (Indicator type, Group type, IR, or Victim) at a time. To associate more than one object type to a Signature, repeat Step 6 for each object type. 7. The **Save**screen will display all the objects selected for association (Figure 7). Click the **SAVE** button to complete the import process. ![Figure%207_Signature%20Import_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_Signature%20Import_7.4.0.png) NoteOnce you have selected an object for association and it is added to the table, you cannot remove it. The only way to remove an object from the table is to click the **Back** button to return to the **Confirm** screen (Figure 3) and then click the **Next** button to proceed to the **Save** screen (Figure 4). --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc. ClamAv® and Snort® are registered trademarks of Cisco Systems, Inc. Iris® is a registered trademark of DomainTools, LLC. Microsoft® is a registered trademark of Microsoft Corporation. Splunk® is a registered trademark of Splunk, Inc. CybOX™ and STIX™ are trademarks of The MITRE Corporation.* 20006-01 v.08.A ## Related - [Structured Indicator Import](/structured-indicator-import.md) - [ThreatConnect Indicator CSV Integration Installation and Configuration Guide](/threatconnect-indicator-csv-integration-installation-and-configuration-guide.md) - [Unstructured Indicator Import](/unstructured-indicator-import.md)