Selecting Sources and Indicators¶
The first step of the extraction process is to provide CTIE with documents to read. This is where the indicators will be extracted from. These documents can be offline or online as long as they are supported CTIE will be able to read their contents. You must also tell the application what do look for, i.e. hashes, emails or IP addresses.
Before the extraction process can occur, you must import documents into CTIE. To import files, follow the steps below:
- Select the Add Files (1) button or press Alt + i. Doing so will open a Open File dialog
- Using the Open File dialog, select one or multiple files (2). You can select multiple files from the same folder by pressing and holding the Ctrl key on your keyboard while clicking on the filenames. Once completed, click on Open (3).
- After clicking Open (3), the dialog will close and the files selected will be added to the Sources section of the main window. Repeat this step as needed to add more files.
CTIE should be able to read and extract indicators from any text file, but may not be able to parse its structure. For example, CTIE will be able to read XML files, but not parse it. Just rename the file to a .txt file to import text-based files in the application.
In some cases, you may prefer to import all the files included in a folder rather than selecting files one by one. CTIE provides the ability to do so by using the Add Folder (1) button in the main window.
Select the folder (2) containing the files you wish to import into CTIE using the Browse For Folder dialog appearing. Click on OK (3) to start importing files.
Only files supported by the application will be imported. All files with unrecognized extensions will not be imported.
Once the program is finished, all files will be listed in the Sources section (4) of the main window.
Selecting and Removing Sources¶
If you want to remove one specific sources follow the instructions below:
- Right-click on the document to remove in the Sources section to show the contextual menu;
- Within the menu, select Remove. The selected file or URL will be removed from the list. You can also press the Delete key.
If you want to remove multiple sources, repeat steps 1 and 2 for each document. To remove all of the selected sources, select the Remove All option.