Showing/Hiding Object Relationships
Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Artifact Management - Investigations
You can expand and hide an object's relationships, both committed and uncommitted, on the Evidence from the Action Panel. This allows you to create a better visual representation of your investigation as well as hide related objects that add little value to the investigation.
Uncommitted related object nodes will only appear on the Evidence Board if you have enabled Exploratory Data Points.
The evidence board and object details menu display a maximum of 2,000 relationships per object and an overall maximum of 25,000 relationships. If the objects in your investigation exceed these maximums, you can view the full list of relationships in the correspond object details pages.
Show a Specific Object Relationship for an Object
- Click on the object's node on the Evidence Board to load its details in the Action Panel.
The Relationships section will be loaded at the bottom of the panel and will be categorized by object type.
- Expand the Relationships categories and locate the object to display on the Evidence Board.
- Click on the plus icon located to the right of the related object name.
The object's node will appear on the Evidence Board with visible data line connecting it to the original object.
- Right-click on the related object and select Commit to Investigation to add the object to the investigation.
Show all Object Relationships for an Object
- Click on the object's node on the Evidence Board to load its details in the Action Panel.
The Relationships section will be loaded at the bottom of the panel and will be categorized by object type.
- Click on the Expand button located towards the top of the panel.
All related object nodes will appear on the Evidence Board with visible data lines connecting them to the original object.
- Right-click on any related object and select Commit to Investigation to add the object to the investigation.
Hide an Object Relationship
Hiding an Object Relationship remove the object's node from the Evidence Board and does not remove it from the parent object or the investigation.
- Click on the object that the related object is attached to on the Evidence Board.
- Locate the object under the Relationships section of the Action Panel.
- Click on the X icon next to the object name to remove it's node from the Evidence Board.
The related object's node will be removed from the Evidence Board.