# Custom Indicators **URL:** \ **Category:** Elastic Security\ **Created:** [June 19, 2024, 3:07am UTC](https://discuss.elastic.co/t/custom-indicators/361688 "2024-06-19T03:07:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![digital-thought](https://avatars.discourse-cdn.com/v4/letter/d/f14d63/32.png) [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Post date:** [June 19, 2024, 3:07am UTC](https://discuss.elastic.co/t/custom-indicators/361688/1 "2024-06-19T03:07:16Z")
It would be great to upload custom Indicators (IPs, file hashes, domains, etc) into the Threat Intelligence capabilities of Elasticsearch Security. I know I could index this material into Elastic using the REST API, however, I was curious if Elastic had considered the ability to add custom indicators via the Security platform in Kibana or if anyone has approached this in another manner. ---
**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\ **Post date:** [June 19, 2024, 10:06am UTC](https://discuss.elastic.co/t/custom-indicators/361688/2 "2024-06-19T10:06:57Z")
Hello @digital-thought! Maybe [value lists](https://www.elastic.co/guide/en/security/current/value-lists-exceptions.html) is something that can help? Value lists can be used in [Indicator Match rule](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#indicator-value-lists) ---
**Author:** ![maxcold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxcold/32/97686_2.png) [@maxcold](https://discuss.elastic.co/u/maxcold)\ **Post date:** [June 20, 2024, 8:31am UTC](https://discuss.elastic.co/t/custom-indicators/361688/3 "2024-06-20T08:31:55Z")
@digital-thought If you need the indicators not only for indicator match rule, but also for other TI functionality, like Intelligence view in Security and Threat Intelligence insights, I believe you can use a small hack and leverage Machine Learning \> Data Visualizer \> File to upload a csv to an index and define the mapping for the data in csv. Mind though, that the mapping should match [ECS schema](https://www.elastic.co/guide/en/ecs/current/ecs-threat.html) for Indicator of Compromise under `threat.indicator.*` and the index should either match the index pattern defined in `securitySolution:defaultThreatIndex` advanced setting (by default it is `logs_ti*`) or you can just add the index to the pattern. As this is not officially supported, there might be things I missed that prevented it from working, but you can play with the functionality and see if it works for you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 18, 2024, 8:32am UTC](https://discuss.elastic.co/t/custom-indicators/361688/4 "2024-07-18T08:32:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.