Current ThreatQ Version Filter
 

Notes

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Objects, Individual Object Context & Actions

Note: If a user has View Only permission for Sources, system object creation modals default to the user’s login as the object source.

Notes objects are STIX 2.1 objects that provide further context and/or additional analysis.  You can export a Note object to PDF, CSV, or STIX. 

Adding Notes

  1. Go to Create > Notes.
    The Add Notes window is displayed.
    Add Notes
  2. Populate the following fields:
    Field  Description
    Value Add a descriptive name for the note.
    Note Author Optional field.  Enter the name of the note author.
    Description Enter the note's description.  If you do not select a source during object creation, the description source defaults to ThreatQ System.
    Point of Contact Optional field. Click the field to select the ThreatQ display name of the point of contact for the note.
    Source Select a Source from the dropdown list provided.
    You can also click the Add a New Source option if the desired source is not listed in the drop-down list. If administrators have enabled TLP view settings, you can select a TLP label for the new source in the dropdown list provided. See the Traffic Light Protocol (TLP) topic for more information on TLP schema.
  3. Select any Related Objects you need to link to the note. This field is optional.
  4. Click Add Notes.

Adding Context

See the About Object Details section and its topics for details on adding context to an object such as adding sources, attributes, and related objects.

Editing Notes

  1. Locate and click the Notes object.
    The Notes Details page opens.
    Notes Details page
  2. Click the Edit option next to the Notes object name.
    The Edit Notes window is displayed.
    Edit Notes Dialog box
  3. Enter your changes.
  4. Click the Save Notes button.

Changing the Point of Contact

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Objects, Individual Object Context & Actions - Point of Contact

  1. Locate and click the system object.
  2. From the object details page, click the Point of Contact field.
  3. Use the field's scroll or search option to locate and select a new user as the object's point of contact or to change the point of contact to Unassigned.

Deleting Notes

  1. Locate and click the Notes object.
    The Notes Details page opens.
    Notes Details page
  2. Click the Actions menu and select Delete Notes.
    The Are You Sure window prompts you to confirm the deletion.

    Note Delete Confirmation box

  3. Click the Delete Notes button.