Current ThreatQ Version Filter
 

Orchestrator Pane

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: See the Interdependent Permissions topic.

To view the Orchestrator pane, your ThreatQ instance must have an active ThreatQ TDR Orchestrator license.

In an object's detail page, the Orchestrator pane lists the name of each TQO workflow that processed the object and the workflow run timestamp.

Orchestrator Pane

Tips and Tricks

  • You can sort the list of workflows by workflow name or timestamp.
  • The Rows per page field allows you to control the number of records, 10, 25, 50, or 100, displayed in each page of the Orchestrator pane.
  • The Orchestrator pane lists deleted as well as enabled/disabled workflows.
  • The Workflow column displays "Deleted Workflow" for any workflow deleted from ThreatQ after processing the object.
  • The Orchestrator pane lists the last ninety days or last 10,000 workflow runs applied to the object, whichever is greater.
  • The Orchestrator pane lists entries for all objects included in a workflow run even if the workflow does not support enrichment of the object type. For example, if Workflow A only enriches indicators and the associated data collection includes the Spider1 adversary, the Orchestrator pane lists Workflow A for Spider1.