Current ThreatQ Version Filter
 

Attributes Pane

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Individual Object Context & Actions - Attributes

The Context section of the object details page displays attributes, sources, and tags associated with the system object.
Attributes Pane

Adding an Attribute to an Object

You can link attributes to a system object.

  1. Locate the Attributes pane on the object details page.
  2. Click on the + Add link located to the top-right.
  3. The Add Details dialog box opens with the Add Attributes tab selected by default.
    Add Attribute Details box
  4. Select an Attribute Type from the Attributes dropdown or enter a new type.
  5. Select an existing Attribute Value from the dropdown or enter a new value.
  6. Select a Source from the dropdown or enter a new source.

    You can select the + icon to add additional attributes.

  7. Select Add Attributes.
Deleting an Attribute from an Object

You can delete an attribute from the object details page.

  1. Locate the Attributes pane on the object details page.
  2. Select the checkbox next to the attribute you want to delete.

    You can select more than one attribute to delete

  3. Select Delete.
    The confirmation dialog box opens.
    Delete Attribute confirmation
  4. Select Delete Attributes.
Deleting an Attribute Source from an Object

You can delete an attribute's source from the object details page.

  1. Locate the Attributes pane on the object details page.
  2. Select the X next to the attribute's source.
    The confirmation dialog box opens.
    Delete Attribute Source Confirmation
  3. Select Delete Attribute Source.
Editing an Object's Attribute

The Edit attribute option allows you to change an attribute's value and source as well as the source's TLP label.

  1. Click the checkbox next to the attribute.

    You can only edit one attribute at a time. If you check the box next to more than one attribute, the Edit option is disabled.

  2. Click the Edit option in the Attributes pane to access the Edit Details window.

    If an attribute has multiple sources, the Edit Details window displays a row for each source so that you can update each attribute as needed.

    Edit Details Window
  3. From the Edit Details window, you can:
    • Update the attribute's value - Select a new value from the dropdown list or click the Add new value link to enter a new value.
    • Add an attribute's source - Select the source you want to add from the dropdown list or click the Add new source link to enter a new source.  The source you select/enter is added to the sources associated with the attribute.  It does not replace the source originally associated with the attribute.
    • Select a new TLP label for the attribute's source - When you add a new source to an attribute, you can use the TLP field to change the default TLP label associated with the source.  If you did not add a new source, you can use the TLP field to change the TLP label assigned to the existing source.  To select a new TLP label, click the arrow next to the current TLP label and select a new one.
  4. After you make your changes, click the Save button.