Article Content
| Overview |
| Related Information/Setup |
| Navigation |
| Creating New Threat Intel |
Overview
The Threat Intel feature documents evidence (e.g., indicators, implications, advice, etc.) regarding a possible threat to a Person or Site/Asset.
Related Information/Setup
Please refer to the Editing an Image article for information on removing, replacing, or editing an image.
Please refer to the Assigning a User to a Threat article for more information on assigning Threat Intel.
Please refer to the Adding a Targeted Entity to a Threat article for more information on adding a targeted entity.
Please refer to the Adding a Threat Actor to a Threat article for more information on adding a threat actor.
Please refer to the Acknowledge and Process a Threat article for more information on processing a Threat Intel.
Navigation
- From the Home screen, click the Home dropdown.
Home Dropdown
- From the Home dropdown menu, click the Threat Protection link.
Threat Protection Link
- From the Threat Intel screen, click the + New Threat Intel button.
+ New Threat Intel Button
Creating New Threat Intel
- From the Create a New Threat Intel screen, select an Intel Priority from the dropdown menu. The Intel Priority indicates the severity of the Threat Intel.
Intel Priority
- Select the date & time the threat occurred by clicking the Key Date & Time dropdown and selecting the Date by clicking a day on the Calendar pop-up and a Time using the Increase and Decrease arrows.
Date & Time
- Enter a Threat Type Name in the Threat Type field and select a Threat Type from the dropdown menu. Threat Types help categorize the threat in the system.
Threat Type Dropdown Menu
- From the Details tab, select an Intel Source from the dropdown menu. The Intel Source indicates where the threat originated (e.g., Online, Internal, etc.).
Intel Source Dropdown Menu
- Add image evidence to the Threat Intel by clicking the designated area within the Intel Image field and selecting an image file from the connected PC or drag and drop an image from the connected PC into the Intel Image field. Users can add an image file (.JPEG, .PNG, or .GIF) to the Image Intel field.
Intel Image Field
- Users can remove, replace, or edit an image by hovering the cursor over the image and clicking the Click to Edit Image link.
Click to Edit Image Link
- Select an Online Trajectory option from the dropdown menu. The Online Trajectory indicates how the threat is currently trending in popularity online.
Online Trajectory Dropdown Menu
- Enter any additional information in the Additional Information field. The Additional Information field is a free-form field used to track additional evidence.
Additional Information Field
- Click the Intel Link icon to add URL references to the Threat Intel.
Intel Link
- From the Add Link pop-up, enter a Display Name. The Display Name is an alternate name used to represent the URL. The URL will be used instead if the Display Name field is blank.
Add Link Pop-up
- Enter the URL Link.
- Click the + Add Link to add the link to the Threat Intel.
+ Add Link
- Click the Edit icon next to an Intel Link to edit the Display Name and URL Link fields.
Edit Icon
- Click the Delete icon next to an Intel Link to delete the Intel Link.
Delete Icon
- Enter a Threat summary in the Intel Summary field. You can apply simple formatting to the text entered in the Intel Summary field.
Intel Summary Field
- Click the Save button to save the content entered in the Intel Summary field.
Save Button
- Intel Summary information from third-party applications (e.g., LifeRaft®, samdesk®, etc.) will be pulled into the Intel Summary field through the integration source system and tagged accordingly (e.g., extracted text).
- Click the Create button to create the Threat Intel.
Create Button
- The Threat Intel Details screen will appear, listing the newly created Threat Intel. The ID Number, Creation Date, and Intel Source will appear on the top left-hand side of the screen, and the Threat Intel ID and Status will appear on the top right-hand side.
Newly Created Threat Intel
- The Threat Intel will appear on the Threat Intel screen under the New Threats section.
New Threat