Current ThreatQ Version Filter
 

Linking/Unlinking Objects

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Artifact Management - Investigations

Linking two object nodes on the Evidence Board creates a visible connection on the evidence board and relates the objects to each other in the Action Panel.  Investigation owners, as well as users with Editor permissions for the investigation, can link and unlink objects in an investigation.    

Linking Two Objects

You can link two objects in an investigation.  Linking an object will add it as a relationship to object in the Action Panel.   

 

  1. Select two object nodes on the evidence board.

  2. Right-click on one of the highlighted objects and select Link from the dropdown menu.



    The objects will now be linked and physical graph line will appear connecting the objects.  The linked object will also appear as relationships in the Action Panel.  

Unlinking an Object

You can unlink two linked objects.  This will remove the objects from their relationships section of the Action Panel.  

  1. Select both linked object nodes on the Evidence Board.

  2. Right-click on the node and select Unlink from the dropdown menu.