Relations
The relationship object describes how objects are related to each other. The Relations tab provides a complete view of the objects related to the threat data object. You can view the relationships in Table View which provides comprehensive details or in Visualizer View which provides a graphical representation of the relationships that allows you to visualize the relationships.
You can view the following details:
Overall Relations: Shows the total number of threat data object types related to this threat data object.
Source Specific Relations: Shows the total number of threat data object types reported per source.
Relationship Details: View the details of the objects related to the threat data object in Table View or Visualizer View.
Table View
You can view the details of the related object such as object type, sub-type, value, relationship type, and more. The following tabs offer a segregated view of the relationships:
Forward: Shows the relationships from the threat data object to other threat data objects.
Reverse: Shows the relationships to this threat data object from other threat data objects.
All: Shows all the relationships of the threat data objects.
Manage Relationships in Table View
You can perform the following additional activities on a relationship in table view:
Show Preview: Select a relationship and click Show Preview to view details such as confidence score, analyst score, TLP, reported by sources, relations count, and tags.
Open in Threat Data: Select a relationship, click More Actions, and click Open in Threat Data which redirects you to view the details of the selected threat data object.
Delete Intel Relation: Select a relationship, click More Actions, and click Delete Intel Relation which deletes the associated relationship with the threat data object.
Visualizer View
You can visualize the relationships of the threat data object through a graphical representation that shows its related objects. This allows you to analyze relationships of the threat data object using an interactive relational visualization on a canvas in addition to viewing it in tabular form.
Manage Relationships in Visualizer View
You can view and perform the following activities on relationships:
Node Details: Select a node or double-click on a node to view the details such as confidence score, analyst score, TLP, reported by sources, relations count, and tags. You can also click View in Threat Data which redirects and opens threat object details
Add Relation: Select a node and select Add Relation and select the object type of the relation, object value of the relation, and the relation type. Click Save. You can view the newly added relation in the visualizer and the Overall Relations widget count.
Intel Exchange supports all the relationship types in compliance with the STIX 2.1 standards.
Layouts: Select different layouts to visualize the relationships.