Files
Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Objects, Individual Object Context & Actions
Note: If a user has View Only permission for Sources, system object creation modals default to the user’s login as the object source.
Files are received from various intelligence providers and may contain technical cybersecurity data such as Indicators, Adversaries, and Malware samples.
Use the steps below to create, edit and delete a File.
Adding Files
- Click Create > File.
The Add a File is displayed.
- Drag the file into the dialog box or browse and locate the file.
The Add a File window displays additional fields.
- Update the Title if desired.
- Select a Source from the dropdown list provided.
You can also click the Add a New Source option if the desired source is not listed in the drop-down list. If administrators have enabled TLP view settings, you can select a TLP label for the new source in the dropdown list provided. See the Traffic Light Protocol (TLP) topic for more information on TLP schema.
- Select a Category.
- Select whether to have the Malware Safety Lock on or off.
Enabling the safety lock will create a password-protected .zip file so any malware is safer for download. The system default password is "infected."
- Add any desired tags.
Tags added will appear on the File's Details page.
- Select any Related Objects you need to link to the file. This field is optional.
- Click Save File.
Adding Context
See the About Object Details section and its topics for details on adding context to an object such as adding sources, attributes, and related objects.
Editing Files
- Locate and click on the file.
The File Details page opens.
- Click on Edit next to the File name.
The Edit File dialog box opens.
- Make the desired change to the File Name.
- Click on Save File.
Deleting Files
- Locate and click on the file.
The File Details page opens.
- Click on Actions menu and select Delete File.
A confirmation dialog box appears.
- Click on Delete File.