Skip to content

Expiration Rules

Indicators don’t stay valid forever. For most of them, they have a defined validity period.

When creating/adding an Indicator to a Content Proposal, analysts have to provide a valid_from (required) and valid_until (optional) date which is the time from which this Indicator is considered a valid indicator of the behaviors it is related to or represents.

This is when Expiration Rules come to play. They have been designed to set default validity periods for Indicators depending on the type of observable they related to.

Default Expiration Rules

By default, these validity periods are:

Observable type Time to live
URL 6 months
IPv4 1 month
IPv6 1 month
Domain name 6 months
Others 6 months
File (hash) 5 years

Example

When importing an IP address into a Content Proposal, if you don't change the fields corresponding to the validity date, it will be automatically set to 1 month in the CTI database.