Current ThreatQ Version Filter
 

Sources Pane

THREATQ REQUIRED PERMISSIONS

Default ThreatQ Role: Administrative, Maintenance, or Primary Contributor
Custom Role - Action Permissions: Objects & Context - Individual Object Context & Actions - Sources

The Sources pane displays all Sources associated with the system object.  From this pane,  Maintenance Account, Administrative Access, and Primary Contributor Access accounts can add a source to the object, update a source's TLP label, or remove a source from the object.  Read Only Access accounts can view sources but not remove or update them.

See the Bulk Add Source section in the Bulk Actions topic for information on adding a source to a group of system objects.

Relationship Limits

If an object has more than 10,000 relationships from the same source, the Sources pane displays a relationship limit badge  with a tooltip listing the source that exceeded the limit.

Within the tooltip, you can click the source to access a Threat Library view filtered by the related to (object name) and relationship criteria (offending source).

If the offending source is not a feed, the Threat Library view does not list related objects. For example, if the offending source is a user (such as threatq@threatq.com) that added the relationships, when you click it, the Threat Library view does not list any related objects.

Adding a Source to an Object

  1. Locate the Sources pane on the object details page.
  2. Click the Add option.
    The Add Details window opens with the Add Source tab selected by default.
    Add Source
  3. Use the Source field's drop-down list to select a source. If TLP is enabled, you can override the source's default TLP label.
    You can also click the Add a New Source option if the desired source is not listed in the drop-down list. If administrators have enabled TLP view settings, you can select a TLP label for the new source in the dropdown list provided. See the Traffic Light Protocol (TLP) topic for more information on TLP schema.

    Even though the Source drop-down lists displays all sources, you cannot add a source to an object if it has already been added.

  4. Click the Add Sources button.

Editing a Source

The Edit Sources window allows you to edit a source’s TLP label (if TLP visibility is enabled via the TLP tab) or remove the source from the object.

  1. Locate the Sources pane on the object details page.
  2. Click the Edit option.
    This Edit Sources window lists all the sources associated with the system object.
    Edit Sources Window
  3. To update the source's TLP, select the new TLP label from the dropdown list and click the Save button.
    To delete the source, click the trashcan icon next to the TLP field and go to step 4.
  4. If you are removing the only source associated with the object, the Are you sure window prompts you to confirm the deletion of the object by clicking the Delete Object button.
    Confirmation Window
    If the object has multiple sources, the Delete Source window prompts you to specify whether you want to delete the source and its related context.  Go to step 5.

    Delete Source Window

  5. To remove the object and its related context, leave the Remove attributes, comments, and relationship links associated with the <source name> source field checked.

    Removing a relationship link does not delete the linked object.  It only removes the link between the objects.

    To remove the source but retain its related context, uncheck the option.

  6. Click the Delete button.
    Deleted sources are recorded in the audit log as Removed.  Removed contexts such as attributes, comments, or relationships are not recorded in the audit log.

Removing a Source from an Object

  1. Locate the Sources pane on the object details page.
  2. Click the + next to pane title, Sources, to expand your view of the pane.
  3. Click the X located to the right of the source's name.
  4. If you are removing the only source associated with the object, the Are you sure window prompts you to confirm the deletion of the object by clicking the Delete Object button.
    Confirmation Window
    If the object has multiple sources, the Delete Source window prompts you to specify whether you want to delete the source and its related context.  Go to step 5.

    Delete Source Window

  5. To remove the object and its related context, leave the Remove attributes, comments, and relationship links associated with the <source name> source field checked.

    Removing a relationship link does not delete the linked object.  It only removes the link between the objects.

    To remove the source but retain its related context, uncheck the option.

  6. Click the Delete button.
    Deleted sources are recorded in the audit log as Removed.  Removed contexts such as attributes, comments, or relationships are not recorded in the audit log.