Current ThreatQ Version Filter
 

Previewing an Object

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Artifact Management - Investigations

You can open a preview tab for investigation objects and related objects from the Action Panel.  From the preview tab, you can perform the same actions that are available from the object's details page including:

  • Update Expiration (Indicators Only)
  • Update Score (Indicators Only)
  • Update object Status (Indicator Only)
  • Add Attributes, Sources, Tags etc.   

Additionally, you can run operations against the previewed object.  

Opening an Object in the Preview Tab

The steps for previewing an investigation or related object differ only in terms of which object you select on the Evidence Board.

  • If the investigation itself is loaded in the Action Panel, you will see an Added to Investigations section at the bottom of the panel. 

    Action Panel - Investigation View
  • If an object node is selected, you will see a Relationships section listed at the bottom.   

    Action Panel - Object View
  1. To view the preview panel, click the Preview icon Preview Icon located to the left of the object name.

    Object Preview Panel
  2. Review and/or update the object's details as needed.  You can also run an operation to pull further context for the object using the Operations tab located at the top of the window.