TISC Data Archival
The Threat Intelligence Security Center is provisioned with archival rules in the base system for the TISC table. The related records are also added in the base system to the TISC archive rule.
Before you begin
Role required: admin
Procedure
Navigate to All > System Archiving > Archival Rules.
The list of archival rules that are applicable for TISC are displayed. These archival rules are different for every object type and are applicable independently.
Filter the tables names starts with sn_sec_tisc.
View the TISC related records.
Threat Intelligence Record Reference Table Archive Attack Pattern sn_sec_tisc_attack_pattern Archive Campaign sn_sec_tisc_campaign Archive Course of Action sn_sec_tisc_course_of_action Archive Data Component sn_sec_tisc_aggregated_data_component Archive Data Source sn_sec_tisc_aggregated_data_source Archive Identity sn_sec_tisc_identity Archive Infrastructure sn_sec_tisc_infrastructure Archive Intrusion Set sn_sec_tisc_intrusion_set Archive Malware sn_sec_tisc_malware Archive Malware Analysis sn_sec_tisc_malware_analysis Archive Marking Definition sn_sec_tisc_marking_definition Archive Object Sighting sn_sec_tisc_object_sighting Archive Observed Data sn_sec_tisc_observed_data Archive Threat Actor sn_sec_tisc_threat_actor Archive Threat Event sn_sec_tisc_threat_event Archive Threat Grouping sn_sec_tisc_threat_grouping Archive Threat Note sn_sec_tisc_threat_note Archive Threat Opinion sn_sec_tisc_threat_opinion Archive Threat Report sn_sec_tisc_threat_report Archive Tool sn_sec_tisc_tool Archive Vulnerability sn_sec_tisc_vulnerability Artifact sn_sec_tisc_artifact AS Number sn_sec_tisc_as_number Directory sn_sec_tisc_directory Email Address sn_sec_tisc_email_address Email Message sn_sec_tisc_email_message Email Subject sn_sec_tisc_email_subject File sn_sec_tisc_file Indicator Archive Rule sn_sec_tisc_indicator IPv4 Address sn_sec_tisc_ipv4_address IPv4 CIDR sn_sec_tisc_ipv4_cidr IPv6 Address sn_sec_tisc_ipv6_address Location sn_sec_tisc_location MAC Address sn_sec_tisc_mac_address MD5 Hash sn_sec_tisc_md5_hash Mutex Name sn_sec_tisc_mutex_name Other Observable sn_sec_tisc_other_observable Process sn_sec_tisc_process SHA1 Hash sn_sec_tisc_sha1_hash SHA256 Hash sn_sec_tisc_sha256_hash SHA512 Hash sn_sec_tisc_sha512_hash URL sn_sec_tisc_url User Account sn_sec_tisc_user_account Windows Registry Key sn_sec_tisc_windows_registry_key X.509 Certificate sn_sec_tisc_x_509_certificate Object-Object Relationship Archive Rule sn_sec_tisc_m2m_object Object-Observable Relationship Archive Rule sn_sec_tisc_m2m_object_observable Related Indicator Archive Rule sn_sec_tisc_m2m_indicator RSS Feed Archive Rule sn_sec_tisc_m2m_object_indicator Imports Archive Rules sn_sec_tisc_m2m_indicator_observable Note:
For information on how the archival rules are created, see Create an archive rule in Core UI.
Select an archival rule.
For example, select Directory observable record to see the base system archival rule.
Update the rule if required.