Skip to main content

Cyware Threat Intelligence eXchange

Perform Bulk Actions on Threat Data

Use the bulk actions to perform actions on multiple threat data objects in one operation.

Note

Read-only users cannot access bulk actions.

To perform bulk actions on threat data objects, do the following:

  1. Go to Main Menu > Collection > Threat Data.

  2. Select the threat data objects and click Bulk Actions.

  3. Select one of the following actions:

    • Add Tags

    • View in Threat Investigations 

    • Add Analyst Score

    • Add TLP

    • Add Relation

    • Add to Indicators Allowed

      Note

      Add to Allowed Indicators is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.

    • Manual Review

    • Mark as Reviewed

    • Add to Watchlist

    • Remove from Watchlist

    • Run Rule

      Note

      Run Rule is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.

    • New Task

    • New Note

    • Create CFTR Case

    • Remove Tags

      Note

      You can remove a maximum of 50 tags from a maximum of 100 threat data objects in one operation.

    • Delete

      Note

      • You must have delete permission for threat data to delete the objects.

      • You can delete a maximum of 100 threat data objects in one operation.

What happens when you delete a threat data object?

When you delete a threat data object:

  • The associated notes, tasks, and the relationship with other objects are also deleted.

  • The object is removed from the threat investigation canvas.

When you delete a published object, the object is revoked from all published collections and a flag revoked = true is sent to the collections.

Note

If all the related threat data objects of a report object are deleted then the report object exists in the platform without any related object. You can delete the empty report object manually.