Current State
Currently, the ThreatQ user interface does not allow users to create new Indicator Types.
While users can create ad-hoc types for other objects such as Events or Attachments, defining new Indicator Types currently requires the ThreatQ API. Some users have leveraged this API to create types such as:
• Routing Number
• Bitcoin Address
• Account Number
• Phone Number
Alternatively, it’s possible to achieve similar outcomes with Custom Objects, though those typically require more configuration and are not as seamlessly integrated across the platform.
We’d like to better understand what would be most useful to you:
• How important is it for your team to create new Indicator Types through the UI?
• What kinds of custom indicators do you need to track most often?
• How would you expect to manage these custom types (naming, categorization, validation)?
• Would UI-based creation replace your current API or custom object workflows?
Your insights will help guide future improvements around Indicator Type flexibility.
👉 If you have a specific approach or workflow in mind, please create a new Idea describing how you’d like to see UI-based custom Indicator creation work.