ThreatQ Expirations Transcript Expirations allow you to deprecate stale intelligence based on a set of defined criteria. The expiration status should be used when an indicator is deemed by an analysts to pose less of a threat to their infrastructure than other indicators. Expiring an indicator relieves the data burden on your team or infrastructure. The expire status should when an indicator is deemed by an analyst to pose less of a threat to their infrastructure than others. You can manually change the expiration date for an individual indicator or multiple indicators in the ThreatQ application. You can also set an automatic expiration policy which allows you depreciate stall intelligence as the data becomes less relevant. You can manually change the status of an individual indicator to expired by navigating to its details page. Click on the status dropdown and select Expired. The Expires field will now read as Expired Today. You can perform the same steps to change an expired indicator to active or any other status. You can perform a bulk action status change the status of a set of indicators to expired using the advanced search function of the Threat Library. Perform an advanced search. Click on the Actions dropdown and select All Indicators under the Bulk Changes heading. Select expired for the new status of the indicators on the Bulk Changes page. ou can also use this process to change the status of expired indicators to active or any other available system status. Click on Apply Changes. The platform will inform you that the bulk action is now queued and when it has completed. The next methods we will cover will show you have to set expiration dates and policies which automatically control the expiration status. Use the following steps to set an individual indicator's expiration. Navigate to an indicator's details page within the ThreatQ platform. You will see an Add Expiration Date link next to the Expires field located at the top of the page. Note, if the indicators expiration date has already been set, you will see an extend link instead. Click on the Add Expiration Date and select Add Seven Days Add Fourteen Days And protect for auto-expiration. This will prevent an automated expiration policy or bulk action from expiring the indicator. The new expiration date will appear next to the expired field. Click on the extend link again to update or remove the expiration setting. Use the following steps to perform a bulk action expiration update. Perform a search in the ThreatQ Threat Library to select the indicators to update. Click on the Actions dropdown and select All Indicators under the Bulk Changes heading. Select the type of change for the expiration date. Optons include Extend Expiration Date Protect for Auto-Expiration Remove the expiration date And set a new expiration date Note, indicators that already have the protect from auto-expiration policy applied will not be affected by a bulk action. Click on Apply Changes. The platform will inform you that the bulk action is now queued and when it has completed. Use the following steps to set an automatic expiration policy. Click on the Threat Library option and select Indicator Expiration under the Data Controls heading. The page will load with the indicator expiration tab loaded by default. Locate the source that will receive the policy by either scrolling down the page or using the search filter Select a policy from the dropdown menu provided for the source. Options include Don't Automatically Expire. This is the application default. This prevents an automatic policy from expiring an indicator. The never expire indicators option prevents an indicator from ever expiring. And Automatically Expire Indicators. You can set a specific amount of days after ingestion, that once reached, will expire the indicator. You can also add exceptions to the policy by clicking on Exceptions to reveal the exceptions form. Click on Add Exception. Select the exception criteria and select the specific amount of days, after ingestion, that once reached, will expire the indicator. Click on Apply to save the changes. In this video, we covered expirations. You learned how to set an expiration status for an individual indicator and for a set of indicators. We also covered setting expiration dates and automatic expiration policies. See the Help Center for information on expirations and the ThreatQ platform.