Selecting Sources and Indicators

The first step of the extraction process is to provide CTIE with documents to read. This is where the indicators will be extracted from. These documents can be offline or online as long as they are supported CTIE will be able to read their contents. You must also tell the application what do look for, i.e. hashes, emails or IP addresses.

Import Files

Before the extraction process can occur, you must import documents into CTIE. To import files, follow the steps below:

1. Select the Add Files (1) button or press Alt + i. Doing so will open a Open File dialog

Click the Add Files (1) button above the Sources section to show the Open File dialog.

2. Using the Open File dialog, select one or multiple files (2). You can select multiple files from the same folder by pressing and holding the Ctrl key on your keyboard while clicking on the filenames. Once completed, click on Open (3).

Select one or multiple files (2) and click on Open (3) to add the selected files as sources.

3. After clicking Open (3), the dialog will close and the files selected will be added to the Sources section of the main window. Repeat this step as needed to add more files.

Note

CTIE should be able to read and extract indicators from any text file, but may not be able to parse its structure. For example, CTIE will be able to read XML files, but not parse it. Just rename the file to a .txt file to import text-based files in the application.

Import Folders

In some cases, you may prefer to import all the files included in a folder rather than selecting files one by one. CTIE provides the ability to do so by using the Add Folder (1) button in the main window.

Select the Add Folder button to show the Browser for Folder dialog to select a folder.

Select the folder (2) containing the files you wish to import into CTIE using the Browse For Folder dialog appearing. Click on OK (3) to start importing files.

Note

Only files supported by the application will be imported. All files with unrecognized extensions will not be imported.

Once the program is finished, all files will be listed in the Sources section (4) of the main window.

Import Links

CTIE allows you to read files directly from the web by specifying Uniform Resource Locators (URLs), e.g. web addresses. The program will read the given web pages and extract indicators from the visible text of its contents. To extract indicators from web pages, you will be required to be connected to the Internet and click on the Add Links button on the main page.

Click on the Add Links on the Source and Indicators Selection Panel to include online documents.

Once clicked, a new window will appear into which you will be able to type or copy/paste multiple links to be imported. Each URL must be specified on an individual line. Note that the content hosted at any address must be a supported by CTIE, otherwise you will receive an error message during the extraction process. For example, an address to a binary file will fail.

After clicking Add Links, the Import Links dialog appears where you can specify one or more URLs.

Simply enter each address on a separate line and select Add Links to import the selected documents.

Warning

Each address must start with the http (or https) prefix, otherwise CTIE will not detect the document as an online file.

Web addresses specified must be to a supported document, otherwise CTIE will not be able to read its contents . At anytime, you can click Cancel to dismiss the dialog without importing the addresses entered.

Enter each URL on a separate line in the Import Links dialog and click Add Links.

After clicking Add Links, the dialog will close and links entered in the Import Links dialog will be added to the Sources section of the main window:

The URLs are then added to the Sources section.

Selecting and Removing Sources

If you want to remove one specific sources follow the instructions below:

1. Right-click on the document to remove in the Sources section to show the contextual menu;
2. Within the menu, select Remove. The selected file or URL will be removed from the list. You can also press the Delete key.

Remove sources by choosing the appropriate option in the contextual menu on the Sources section.

If you want to remove multiple sources, repeat steps 1 and 2 for each document. To remove all of the selected sources, select the Remove All option.

Selecting Indicator Types