TTL (Time-to-Live) refers to the amount of time a threat indicator remains within a threat feed. A threat indicator's default time to live can vary based on the type of threat from less than a day to up to a year.  

Viewing Default TTLs

To view Default TTLs, perform the following:

1. From the Cloud Services Portal, click Research > Resources.
2. On the Resources page, click Default TTLs in the top menu. The following information is displayed:
   • Class: The class of a given threat indicator in a threat feed. The Class column can be sorted in ascending or descending order by clicking on its column header. 
   • Property: The property of a given threat indicator in a threat feed. The Property column can be sorted in ascending or descending order by clicking on its column header. 
   • TTL: The Time-to-Live for a given threat indicator in the threat feed. The TTL column can be sorted in ascending or descending order by clicking on its column header.