Perform Bulk Actions on Threat Data
Use the bulk actions to perform actions on multiple threat data objects in one operation.
Note
Read-only users cannot access bulk actions.
To perform bulk actions on threat data objects, do the following:
Go to Main Menu > Collection > Threat Data.
Select the threat data objects and click Bulk Actions.
Select one of the following actions:
Add Tags
View in Threat Investigations
Add Analyst Score
Add TLP
Add Relation
Add to Indicators Allowed
Note
Add to Allowed Indicators is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.
Manual Review
Mark as Reviewed
Add to Watchlist
Remove from Watchlist
Run Rule
Note
Run Rule is only applicable for indicators. If you select different types of threat data objects, this option will not be visible.
New Task
New Note
Create CFTR Case
Remove Tags
Note
You can remove a maximum of 50 tags from a maximum of 100 threat data objects in one operation.
Delete
Note
You must have delete permission for threat data to delete the objects.
You can delete a maximum of 100 threat data objects in one operation.
What happens when you delete a threat data object?
When you delete a threat data object:
The associated notes, tasks, and the relationship with other objects are also deleted.
The object is removed from the threat investigation canvas.
When you delete a published object, the object is revoked from all published collections and a flag revoked = true
is sent to the collections.
Note
If all the related threat data objects of a report object are deleted then the report object exists in the platform without any related object. You can delete the empty report object manually.