Skip to main content

Cyware Threat Intelligence eXchange

Create Threat Investigations Canvas

You can create a new canvas and plot threat data objects, providing threat analysis to correlate contextual understanding gathered from complex threat intelligence data.

Before you Start

Ensure that you have Create, View & Update Threat Investigations permissions.

Steps

To create a new threat investigation canvas, follow these steps:

  1. Go to Main Menu > Analysis > Threat Investigations and click Create New.

  2. Enter a unique title for the canvas within 100 characters that identifies the purpose of the canvas, for example, Indicator Analysis, and click Add. You can view the canvas.

  3. Click Add Node icon on the left. You can view the Indicator, Domain Objects, and Observables.

  4. Select an object type that you need for your investigation or drag it to the canvas. All the SDOs in the Threat Data module are supported. For example, Email Address

  5. Enter the value of the object. For example john.doe@mail.com.

    If a value is displayed in the field below the indicator being added indicates that the Intel Exchange already has a record of the indicator or SDO. If the value is not displayed, that indicates Intel Exchange has no record of the indicator or SDO.

  6. Select a node and drag the + icon to another node to add a relationship between the nodes. You can draw one-to-many or many-to-one relations to different nodes. Once a relationship is established, clicking on the relation name allows you to edit or add details about the threat objects.

  7. Fill in the Relation Details:

    1. Relation Type: Select the type of relationship that exists between the two threat data objects.

    2. Relationship Confidence: Indicate the confidence level of the relationship based on the analysis.

    3. Created by Reference: Specify the reference that identifies the creator or source of the relationship.

    4. Start Date: Select the timestamp representing when the relationship between the two objects began.

    5. End Date: Select the timestamp representing when the relationship between the two objects ended.

    6. Reason: Provide a brief explanation or rationale for establishing the relationship.

    Intel Exchange supports all the relationship types in compliance with the STIX 2.1 standards.

  8. Click Save.

You can view the plotted threat data objects and the specified relationship between nodes in the canvas.