Identities
Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Objects, Individual Object Context & Actions
Note: If a user has View Only permission for Sources, system object creation modals default to the user’s login as the object source.
An Identity contains basic identifying information for targeted groups such as information sources, threat actor identities, and targets of attack.
Use the steps below to create, edit and delete an Identity.
Adding an Identity
- Go to Create > Identity.
The Add Identity window is displayed.
- Populate the following fields:
Field Description Name Add an identity name. Description Add a brief description of the identity object. Status Optional field. Click the Status field to assign a status to the identity. Indentity statuses are configured in the Object Statuses tab in the Object Management page. If none are configured, this field is not displayed.
Contact Information Enter any contact information for the identity. Point of Contact Optional field. Click the field to select the ThreatQ display name of the point of contact for the identity. Source Select a Source from the dropdown list provided. You can also click the Add a New Source option if the desired source is not listed in the drop-down list. If administrators have enabled TLP view settings, you can select a TLP label for the new source in the dropdown list provided. See the Traffic Light Protocol (TLP) topic for more information on TLP schema. - Select any Related Objects you need to link to the Identity. This field is optional.
- Click the Add Identity button.
Adding Context
See the About Object Details section and its topics for details on adding context to an object such as adding sources, attributes, and related objects.
Editing an Identity
- Locate and click on the Identity.
The Identity's detail page opens.
- Click on Edit next to the Identity's name.
The Edit Identity dialog box opens.
- Make the desired change to the Identity's name and click Save Identity.
Changing the Point of Contact
Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Objects, Individual Object Context & Actions - Point of Contact
- Locate and click the system object.
- From the object details page, click the Point of Contact field.
- Use the field's scroll or search option to locate and select a new user as the object's point of contact or to change the point of contact to Unassigned.
Deleting an Identity
- Locate and click on the Identity.
The Identity's details page opens.
- Click on the Actions menu and select Delete Identity.
A confirmation dialog box appears.
- Click on Delete Identity.