Article Content

Overview

Users can add a Threat Actor to a Threat to track the Individual who caused harm through a cyber threat or harm to a system. Threat Actors can be added when creating a new Threat Intel when triaging a Threat or for Threat integrated into Resolver from a third-party online monitoring tool (e.g., LifeRaft®, samdesk®, etc.).

Related Information/Setup

Please refer to the Creating New Threat Intel article for more information on creating a new Threat Intel.

Please refer to the Viewing a Threat Actor's Profile Details article for more information on viewing Profile Details, History, Threats Posted, and Threat Monitoring.

Navigation

1. From the Home screen, click the Home dropdown.

Home Dropdown

2. From the Home dropdown menu, click the Threat Protection link.

Threat Protection Link

3. From the Threat Intel screen, click a Threat Intel link under the New Threats section.

Threat Intel Link

Adding a Threat Actor to a Threat

1. From the Threat Intel Details screen, click the Threat Actors tab.

Threat Actors

2.  From the Threat Actors tab, click the Search field under the Posted by table and enter a Threat Actor's digital presence. A Threat Actor's Digital Presence is a user ID associated with a social platform to post opinions online.

Search Field

3. Select a Digital Presence from the Search dropdown menu. Multiple Digital Presence can be added to a Threat.

Search Dropdown Menu

4. Click the Delete (x) icon to remove the Digital Presence from the Threat.

Delete (x) Icon

5. A Confirmation pop-up will appear, indicating that deleting the Digital Presence will only remove it from the Threat and not from the system.

Confirmation Pop-up

6. Click the Yes button to remove the Digital Presence from the Threat. 

Yes Button

7. Click the Add (+) icon to add a new Digital Presence to the system.

Add (+) Icon

8. The following Digital Presence information will be pulled into the Posted by table when you add a Digital Presence to a Threat:
   • Name: Displays the Threat Actor's user ID and the corresponding social platform.
   • Platform: Displays the name of the social platform the Threat Actor uses to post the threat.
   • User Account: Displays the Threat Actor's user ID on the corresponding social platform.
   • Threats Posted: The number of threats the Threat Actor has posted on the corresponding social platform.

Targeted Entities Table

9. Click anywhere in the Posted by table to open the Digital Presence pop-up to view Profile Details, History, Threat Posted, or Threat Monitoring.

Digital Presence Pop-up

10. Users can link special interest groups to a Threat by adding a Threat Group. Threat Groups connect Threats and Threat actors to Threat Groups (Special Interest Groups).
11. Click the Search field under the Threat Group table and enter a Threat Group.

Search Field

12. Select a Threat Group from the Search dropdown menu. Multiple Threat Groups can be added to a Threat.

Group Dropdown Menu

13. Click the Delete (x) icon to remove the Threat Group from the Threat.

Delete (x) Icon

14. Click anywhere in the Threat Group table to open the Group pop-up to view Group Details, Members, etc.

Group Pop-up

15. After filling out the threat actor tab, you can choose to process and acknowledge the threat within the system by clicking the Acknowledge & Process button, or the user can assign the threat to another user if additional investigation needs to take place.

Acknowledge & Process Button