Skip to main content

Perform Bulk Actions on Threat Data

Use the bulk actions to perform actions on multiple threat data objects in one operation.

Note

Read-only users cannot access bulk actions.

To perform bulk actions on threat data objects, follow these steps:

  1. Go to Main Menu > Collection > Threat Data.

  2. Select the threat data objects and click Bulk Actions.

  3. Select one of the following actions:

    • Add Tags

    • View in Threat Investigations 

    • Add Analyst Score

    • Add TLP

    • Add Relation

    • Add to Indicators Allowed

      Note

      Add to Allowed Indicators is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.

    • Manual Review

    • Mark as Reviewed

    • Add to Watchlist

    • Remove from Watchlist

    • Run Rule

      Note

      Run Rule is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.

    • New Task

    • New Note

    • Create CFTR Case

    • Remove Tags

      Note

      You can remove a maximum of 50 tags from a maximum of 100 threat data objects in one operation.

    • Delete

      Note

      • You must have delete permission for threat data to delete the objects.

      • You can delete a maximum of 100 threat data objects in one operation.

What happens when you delete a threat data object?

When you delete a threat data object:

  • The associated notes, tasks, and the relationship with other objects are also deleted.

  • The object is removed from the threat investigation canvas.

When you delete a published object, the object is revoked from all published collections and a flag revoked = true is sent to the collections.

Note

If all the related threat data objects of a report object are deleted then the report object exists in the platform without any related object. You can delete the empty report object manually.