--- title: "Unstructured Indicator Import Knowledge Base Article | ThreatConnect" slug: "unstructured-indicator-import" description: "This article discusses how to import Indicators from unstructured documents into ThreatConnect." tags: ["Getting Started", "Importing Data"] updated: 2024-03-20T23:23:37Z published: 2024-03-20T23:23:37Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Unstructured Indicator Import ## Overview The ThreatConnect® import engine can extract Indicators from unstructured documents, create them in ThreatConnect, and associate them to a Group. If desired, the source file used to upload Indicators can be saved as a Document Group and associated to the newly created Indicators. IMPORTANTBefore performing the import, [create a Group](https://knowledge.threatconnect.com/docs/create#creating-a-group) with which to associate the imported Indicators, as it will not be possible to create the Group during the import process. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | None | ## Performing an Unstructured Indicator Import 1. On the top navigation bar, hover the cursor over **Import** and select **Indicators**. The **Import Indicator** screen will be displayed (Figure 1). ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-0raqizya.png) 2. Select **UNSTRUCTURED** to display the **Import** **Indicators - Unstructured** screen (Figure 2).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-kyrhyolq.png) - **Owner**: Select an owner (i.e., Organization, Community, or Source) into which the Indicators will be imported. - **+ IMPORT FILE**: Click this button to locate and select a file containing Indicators to upload. - **Text**: After a file has been uploaded, its contents will be displayed in this box. You may also enter text directly into the box. - **Text Replacement**: Use the **Find:**and **Replace:**fields to make multiple changes of the same kind to contents in the **Text:**box (e.g., replacing text such as “hxxp” and “[.]”to re-fang Indicators). - **Find**: Enter the text you want to locate in the **Text:**box. - **Replace**: Enter the new text that will replace text in the **Text:**box that matches the text entered in the **Find:**field. - Click the **APPLY**button to perform the text replacement operation. - **History**: If you performed a text replacement operation during a previous Indicator import, the values entered in the **Find:**and **Replace:**fields will be displayed in this section. Click the **APPLY**button to perform a text replacement operation using those same values. - Click the **Next** button. 3. The **Validate**screen will be displayed (Figure 3).NoteIf an Indicator has been placed on an [Indicator Exclusion List](https://knowledge.threatconnect.com/docs/creating-indicator-exclusion-lists), the text “(excluded)” will be displayed to the right of its name in the **Value** column. You will also not be able to select the Indicator for import, as no checkbox will be displayed in the leftmost column.NoteThreatConnect's import engine uses regular expressions to parse Indicators from the supplied text and thus may include false positives in the list (e.g., **google.com** as a valid host).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-t99b5oao.png) - **Choose Import Options**: If desired, use this dropdown menu to filter Indicators by type. - Select the checkbox in the leftmost column for each Indicator that you want to import. - **Private**: If a System Administrator has enabled [private Indicators](https://knowledge.threatconnect.com/docs/private-indicators) in your ThreatConnect instance, a **Private**column will be displayed to the right of the **Value**column. Select the checkbox for each Indicator that you want to be marked as private. - Click the **Next** button. 4. The **Confirm** screen will be displayed (Figure 4). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-o34riusz.png) - **VIEW**: Click the **VIEW** buttons in the **New Indicators**and **Existing Indicators**sections to view the new and existing Indicators, respectively, that you selected for import. - Click the **Next**button. 5. The **Optional Data**screen will be displayed (Figure 5).NoteThe information entered on the **Optional Data** screen will be applied to all imported Indicators. There is currently no way to enter separate information for individual Indicators.![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-fe79qehy.png) - **Description**: Enter a [Description](https://knowledge.threatconnect.com/docs/the-description-attribute) for all imported Indicators. - **Source**: Enter a [Source](https://knowledge.threatconnect.com/docs/sourcing-data) for all imported Indicators. - **Threat Rating**: Set the [Threat Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for all imported Indicators. - **Confidence Rating**: Set the [Confidence Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for all imported Indicators. - **Active**: Select this checkbox to set the [Indicator Status](https://knowledge.threatconnect.com/docs/indicator-status) of all imported Indicators as active, or clear the checkbox to set the Indicator Status of all imported Indicators as inactive. - **Update Existing Status**: Select this checkbox to update the Indicator Status of any imported Indicators that already exist in ThreatConnect to the status indicated by the **Active** checkbox. If you do not select the **Update Existing Status**checkbox, the Indicator Status of imported Indicators that already exist in ThreatConnect will be left unchanged.NoteAll imported Indicators must have the same Indicator Status. There is currently no way to set Indicator Status for individual Indicators in the unstructured-import process. - **DNS**: Select this checkbox to enable [DNS resolution tracking](https://knowledge.threatconnect.com/docs/dns-resolutions) for all imported Host Indicators. - **Whois**: Select this checkbox to enable [Whois lookups](https://knowledge.threatconnect.com/docs/whois-registration-information) for all imported Host Indicators. - Click the **Next**button. 6. The **Labels** screen will be displayed (Figure 6).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-4t1aqenv.png) - **Security Labels**: Select [Security Labels](https://knowledge.threatconnect.com/docs/applying-security-labels) to apply to all imported Indicators. - **Tags**: Enter [Tags](https://knowledge.threatconnect.com/docs/applying-tags) to apply all imported Indicators. - Click the **Next** button. 7. The **Save** screen will be displayed (Figure 7).![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-8l5hm8gd.png) - **Create Document and associate to indicators using this file**.: Select this checkbox to create a [Document Group](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#group-types) containing the source file and [associate](https://knowledge.threatconnect.com/docs/associations)it to all imported Indicators.NoteThis checkbox will not be displayed if you manually entered Indicators into the **Text:** box in Figure 2 instead of importing them from a file, as there is no imported file with which to associate them. - **Document Name**: If you selected the **Create Document and associate to indicators using this file.**checkbox, a **Document Name:**field will be displayed automatically. Enter the name for the Document Group. - **+ NEW ASSOCIATION**: Click this button to associate all imported Indicators to existing Groups. It is highly recommended that Indicators be associated to a Group; otherwise, they are orphaned and provide minimal value to future analysis. - If you do not want to associate all imported Indicators to existing Groups, click the **SAVE**button to complete the import process. Otherwise, follow Steps 8–10. 8. Clicking the **+ NEW ASSOCIATION**button will display the **Select an Association**window (Figure 8). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-haz9dl1e.png) 9. Use the **Select Type** dropdown to select the type of Group to associate with all imported Indicators. After a Group type is selected (**Adversary** in this example), the **Select an Association**window will display all Groups of that type (Figure 9). ![Graphical user interface, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-8ldtix45.png) - **Filter**: If desired, enter a search term in this field and click the **magnifying glass** ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-4w0bdjj8.png) to narrow the results. - Select the checkbox for each Group to associate to all imported Indicators. - Click the **SAVE**button.NoteWhen associating Groups to imported Indicators, you can only associate Groups of a single type at a time. To associate more than one Group type to all imported Indicators, repeat Step 9 for each Group type. 10. The **Save**screen will display the selected Group(s) to associate to the imported Indicators (Figure 10). Click the **SAVE**button to complete the import process.![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/unstructured-indicator-import-image-737bmbb5.png) NoteOnce you have added a Group to the table, it cannot be removed. The only way to remove a Group from the table is to click the **CANCEL** button and restart the Indicator import process. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20008-01 v.09.C ## Related - [Creating Indicator Exclusion Lists](/creating-indicator-exclusion-lists.md) - [Email Import](/email-import.md) - [Exporting Indicators](/exporting-indicators.md) - [Signature Import](/signature-import.md) - [Structured Indicator Import](/structured-indicator-import.md) - [Using Automated Email Ingest](/using-automated-email-ingest.md)