Manage Nodes
After you add a node, you can further manage and configure it by right-clicking on the node and using the following options:
Edit: Update the node details.
New Note: Create a note to include additional information about the node.
Add Tags: Assign tags to the selected node.
Add Analyst Score: Set a score between 0 - 100 based on your expertise and knowledge.
Add TLP: Assign a TLP value, such as RED, AMBER, and more to the node.
Manual Review: Mark the node for a manual review by an analyst.
False Positive: Mark the node as false positive and flag it as non-malicious.
New Task: Create a task related to the node that needs to be done.
Follow: Follow or track the selected node.
Add to Watchlist: Add a node to a watch list for tracking.
Create a CFTR Incident: Create a CFTR case from CTIX for the node to perform a detailed investigation.
Enrich: Enrich the node with the configured Enrichment tools to add more context.
Analyze Relations using CTIX: Analyze if the selected node has any relations with other objects in the platform and adds that relation to the canvas.
Run Rule: Manually runs a rule from Threat Investigations. As you select this option, CTIX displays the list of rules created with the Run Rule Manually Only option. You can choose the rule to run on the selected nodes of the type indicator, malware, and vulnerability.
Deprecate: Deprecate a node that is no longer an issue.
Add to Indicators Allowed: Add a node to an allow list and flag it as non-malicious.
Delete Canvas Relation: Deletes the relationship between the nodes from the canvas. However, this delete functionality is only applicable to the canvas and does not affect the Threat Data objects. You can right-click on the relationship link between the nodes to delete a relationship.
Delete Intel Relation: Deletes the relationship between the threat data objects permanently. This action also removes the relationship between the nodes in the canvas.