IoC retraction removes an indicator from destination systems after the source plugin reports that the indicator was retracted (for example, withdrawn as a false positive). Retraction is a separate process from sharing, and each indicator carries a Sharing status and a Retraction status per destination configuration.
Prerequisites
- IoC(s) Retraction is enabled under Settings > Threat Exchange, with a Retraction Interval set.
- The source plugin supports fetching retraction information.
- The destination plugin supports deleting indicators. If it does not, retraction is skipped for that destination.
- The destination configuration is enabled and is used in at least one sharing configuration.
How it works
- Detect. An indicator is marked Retracted in one of two ways:
- Automatically: At each Retraction Interval (in days), Cloud Exchange asks each enabled source configuration which of its active, not-yet-retracted indicators were retracted. An indicator is treated as retracted if it was deleted at the source, falls outside the retraction interval in the plugin configuration, or falls outside the plugin configuration’s pulling scope.
- Manually: A write-access user turns the Retracted switch on for a source entry in Threat IOCs (not available for CRE-sourced indicators). This only updates statuses; deletion from destinations happens in the destination’s next sharing cycle.
- Decide. For each destination, the Retraction status is set to Pending only if the indicator’s Sharing status for that destination is Shared (the destination is listed in Shared With). In every other case it is set to N/A, because there is nothing to remove.
- Retract. On the next scheduled sharing cycle of the destination configuration (so the timing follows that destination’s sync interval), Pending indicators are sent to the destination plugin for deletion, in batches. On success the Retraction status becomes Retracted; on failure, Failed.
- Stop sharing. Retracted indicators are excluded from all further sharing, including manual sync.
Indicators derived from CRE / Unified Mapping entities are not retracted.
Status reference
| Sharing Status | Meaning |
|---|---|
| Pending | Qualifies for sharing; waiting for the next sharing cycle |
| Shared | Successfully pushed to the destination |
| Failed | The push to the destination failed |
| N/A | Not applicable; no push will be attempted |
| No status | Never evaluated for this destination |
| Retraction Status | Meaning |
|---|---|
| Pending | Retracted at source and shared with destination; deletion queued |
| Retracted | Deleted from the destination |
| Failed | Deletion was attempted and failed |
| N/A | Nothing to delete, or retraction is disabled for the destination |
| No status | Indicator is not retracted |
Scenarios
“Business rule” means the indicator matches a business rule. “Sharing” means a sharing configuration maps that rule to the destination.
| Business rule | Sharing | Indicator retracted at source | Result |
|---|---|---|---|
| Yes | Yes | No | Shared; no retraction status |
| Yes | Yes | Yes | Shared; retraction goes Pending, then Retracted |
| Yes | Yes | Un-retracted after being retracted | Removed from Shared With, sharing set to Pending, then Shared again on the next cycle; retraction status cleared |
| Yes | No | No / Yes | Not shared; retraction N/A when retracted |
| No | Yes or No | No | No sharing status; no retraction status |
| No | Yes or No | Yes | No sharing status; retraction N/A |
Important Factors
- Un-retracting (turning the switch off, or the source pulling the indicator again) clears the retraction status and sets the sharing status for every possible destination back to Pending. The destination is removed from Shared With until the next sharing cycle pushes the indicator again. An indicator that no longer qualifies then moves to N/A.
- Pending sharing entries that were not picked up in a sharing cycle are set to N/A at the end of that cycle.
- If the destination plugin reports that retraction is disabled in its configuration, all queued indicators are set to N/A rather than Failed.
- Delete Inactive IoC(s) Indicators: inactive and retracted indicators are deleted only after their retraction status is verified.
- When you test a sync or manual sharing, retracted IoCs are excluded from the total count.