Install-Configure-Upgrade
Install on CentOS
Start here CentOS
Review the release notes CentOS
Install the platform on CentOS
Before you start CentOS
About the install script CentOS
Check requirements CentOS
Set up repositories CentOS
Install on one machine CentOS
Install on two machines CentOS
Perform a distributed installation CentOS
Migrate databases CentOS
Configure the platform on CentOS
Upgrade the platform on CentOS
Prepare upgrading to Elasticsearch 7 CentOS
Before you upgrade CentOS
Upgrade the platform CentOS
After upgrading CentOS
Backup guidelines CentOS
Reference CentOS
Packaging system CentOS
Ingestion for sysadmins CentOS
Config and log files CentOS
Whitelist URLs CentOS
Default users CentOS
Default access permissions CentOS
Statsite reference CentOS
Install on RHEL
Start here RHEL
Review the release notes RHEL
Install the platform on RHEL
Before you start RHEL
About the install script RHEL
Check requirements RHEL
Set up repositories RHEL
Install on one machine RHEL
Install on two machines RHEL
Perform a distributed installation RHEL
Migrate databases RHEL
Configure the platform on RHEL
Upgrade the platform on RHEL
Prepare upgrading to Elasticsearch 7 RHEL
Before you upgrade RHEL
Upgrade the platform RHEL
After upgrading RHEL
Backup guidelines RHEL
Reference RHEL
Packaging system RHEL
Ingestion for sysadmins RHEL
Config and log files RHEL
Whitelist URLs RHEL
Default users RHEL
Default access permissions RHEL
Statsite reference RHEL
Install as a virtual appliance VM
Review the release notes VM
Before you start VM
Install the platform VM
Create the admin user VM
Launch the platform VM
Install Neo4j VM
Upgrade the platform VM
Before you upgrade VM
After upgrading VM
Install offline
Review the release notes offline
Before you start offline
Install from an offline location
License information
License information backend and API
License information frontend and UI - 1
License information frontend and UI - 2
License information frontend and UI - 3
License information frontend and UI - 4
License information frontend and UI - 5
License information frontend and UI - 6
License information frontend and UI - 7
License information frontend and UI - 8
License information frontend and UI - 9
License information frontend and UI - 10
License information frontend and UI - 11
License information frontend and UI - 12
License information frontend and UI - 13
License information frontend and UI - 14
License information frontend and UI - 15
License information frontend and UI - 16
License information frontend and UI - 17
License information frontend and UI - 18
License information frontend and UI - 19
Offer to provide source code
Configure Intelligence Center settings
Update the settings
Run diagnostic tests
Audit the system
Monitor system health
Check ingestion performance
Install the extensions
eiq-platform command line
Intelligence Center system settings
Check system health
Configure general settings
Configure STIX
Configure TAXII
Register the license
View system jobs
Configure services
Configure a proxy
Configure Postfix
Configure SSL and HTTPS in Nginx and Neo4j
Elasticsearch 7: “Data too large”
ElasticSearch performance
Set logging levels
Tune PostgreSQL performance CentOS
Configure external authentication systems
Managing external users
Set up LDAP
Set up LDAP and AD authentication
Set up OAuth 2.0 and Azure AD
Set up SAML authentication
Set up SAML with Azure AD
Get to know the platform
About beta features
About ingestion
Command palette
Tags-210
Production
Customize list columns - Production
Edit entities in Production
Filter entities in Production
Browse
Customize list columns - Browse
Edit entities in Browse
Filter entities in Browse
Discovery
Add entities from the discovery service
Edit entities in Discovery
Customize list columns - Discovery
Exposure
About Exposure
Configure Exposure
View Exposure
Edit entities in Exposure
Review exposure
Override Exposure
Customize list columns - Exposure
Graph
About the graph
Create a graph
Access the graph
Add entities to the graph
Analyze entities in a graph
Group entities in a graph
Edit entities on a graph
Publish entities in a graph
Remove entities from a graph
Add a relationship to a graph
Edit relationships in a graph
Publish relationships in a graph
Remove relationships from a graph
Add observables to the graph
Publish observables in a graph
Edit observables in a graph
Remove observables from a graph
Delete observables from a graph
Review enrichment observables
Move around on the graph
Graph on Neighborhood tab
Add graph to workspaces
Filter entities with the timebar
Filter entities with the histogram
Toggle visualization layouts
Save and export the graph
View full titles in the graph
Sync the graph database
Address graph ingestion issues
Search
About search
About search tokenization
Search field
Search query fields
Search query syntax
Search for entity types
Search for entity attributes
Search for enrichment observables
Search by destinations
Search by link name
Search by relationship
Search by tags
Search by date and time
Add entities from search
Sync the search database
Filters
About filters
About source reliability
About TLP
Filter entities by source
Filter entities by TLP
Filter entities with histogram
Filter entities with timebar
Use the context filters
Use the quick filters
Workspaces
About workspaces
Access workspaces
Default public workspace
Create workspaces
List and unlist workspaces
Add edit and remove entities
Add edit and remove datasets
Add and remove graphs
Tasks
Add collaborators
Remove collaborators from a workspace
Create user tasks
View tasks
Edit tasks
Write and review comments
Edit workspaces
Archive workspaces
Restore workspaces
Delete workspaces
View workspace history
Datasets
About datasets
Create a dataset
Add entities to a dataset
Edit entities in a dataset
Edit a dataset
Delete a dataset
Dataset metrics
Rules
Discovery rules
About discovery rules
Create discovery rules
View discovery rules
Enable and disable discovery rules
Apply discovery filters to view specific entities
Apply discovery rules to retrieve specific entities
Manually run discovery rules
Edit discovery rules
Delete discovery rules
Enrichment rules
Add enrichment rules
View enrichment rules
Enrich
Edit enrichment rules
Delete enrichment rules
Entity rules
About entity rules
Create entity rules
About criteria for entity rules
About actions for entity rules
Filter entity rules
Edit entity rules
Delete entity rules
Observable rules
Add an observable rule
View matching observables
Filter observables rules
Edit observables rules
Delete observables rules
Delete matching observables
Observable rule example
Policies
Account policies
Configure account policies
Data policies
About data policies
Create data policies
Manage data policies
Permissions
Default platform roles
Platform permissions
Permissions to access settings
Permissions to access data
Permissions for public API endpoints
Token-based authentication
About token-based authentication
Create an API token
Use an API token
Delete an API token
Two-factor authentication
About two-factor authentication
Enforce two-factor authentication
Set up two-factor authentication
Suspend two-factor authentication
Generate new recovery codes
Recover two-factor authentication
Disable two-factor authentication
Review two-factor authentication activity
Users
User permissions
Manage users
Manage groups
Manage roles
Manage notifications
Manage automation users
Export and import users groups and roles
Additional save options
View the help
Knowledge packs
Work with intelligence
STIX 1.2
About Entities
STIX 2.1
About STIX 2.1 objects
STIX 2.1 indicator
STIX 2.1 Observed Data SDO
STIX 2.1 Identity SDO
STIX 2.1 Common Properties
STIX 2.1 Cyber-observable Objects
STIX 2.1 Interoperability
STIX 2.1 Data Markings
STIX 2.1 STIX Patterns
Entities
Entity details
Access the entity detail pane
Examine the entity overview
Entity versions
Entity history
Manually enrich observables
Create a sighting from an observable
Create an indicator from an observable
Observables tab
Manually add observables
Neighborhood tab
Set relationships
JSON tab
Download PDFs
Create entities
Draft and published entities
Create a campaign
Create a course of action
Create an exploit target
Create an incident
Create an indicator
Create a report
Create a sighting
Create a threat actor
Create a TTP
Edit entities
Copy entities
View and search
Dashboard overview
Search for entities
Discover
Act on exposed entities
Manage
Manual upload
Manually upload files
Review uploaded files
Upload failure
Export entities
Download entities
Merge entities 1
About merging entities
Create merge rules
Delete entities
Observables
About observables
Access observables
Add observables
Edit observables
Delete observables
Set maliciousness
Search for observables
Relationships_1
About relationships
Reports
Create reports
General options for reports
Information source details
Metadata information
Relationships
Add observables to reports
Disseminate reports through outgoing feeds
Save and publish reports
Export reports
Taxonomy
About taxonomy
Create a taxonomy entry
Edit a taxonomy entry
Filter by tag and taxonomy
Delete a taxonomy entry
MITRE ATTACK
Integrations
Extensions
Enrichers
About enrichers
Configure enrichers
Run enrichers
Rules for enrichers
Saving data
List of enrichers
Enricher - Censys
Enricher - CentralOps Domain Dossier
Enricher - CIDR Expander
Enricher - CIRCL IPs related to SSL certificate
Enricher - CIRCL SSL Certificate Fetcher
Enricher - Cisco ASN Info
Enricher - Cisco DNS RR History
Enricher - Cisco Malicious Domains
Enricher - Cisco Related Domains
Enricher - Cisco Threat Grid
Enricher - Cisco Umbrella Threat Grid integration
Enricher - Cisco Whois
Enricher - Crowdstrike Falcon Intelligence Indicator enricher
Enricher - CVE Search
Enricher - DomainTools Iris Investigate
Enricher - DShield
Enricher - Elasticsearch sightings
Enricher - Farsight DNSDB
Enricher - FireEye iSIGHT
Enricher - Flashpoint Forum Visits
Enricher - Flashpoint Torrents
Enricher - Fox-IT InTELL Portal
Enricher - GreyNoise API
Enricher - HybridAnalysis
Enricher - Intel 471 Adversary Intelligence Enricher
Enricher - Intel 471 enricher
Enricher - Intel 471 Posts Enricher
Enricher - Kaspersky
Enricher - MaxMind GeoIP
Enricher - MISP API enricher
Enricher - NSFocus Intelligence
Enricher - OpenResolve
Enricher - Palo Alto Autofocus
Enricher - PassiveTotal IP/Domain
Enricher - PassiveTotal Malware
Enricher - PassiveTotal Passive DNS
Enricher - PassiveTotal Whois
Enricher - PhishTank
Enricher - Proofpoint Email Threat
Enricher - PyDat
Enricher - Qualys Enricher
Enricher - Recorded Future
Enricher - RIPEstat GeoIP
Enricher - RIPEstat Whois
Enricher - Shodan
Enricher - Silobreaker
Enricher - Splunk sightings
Enricher - SpyCloud Breach Data
Enricher - ThreatCrowd
Enricher - Unshorten-URL
Enricher - VirusTotal
Enricher - VirusTotal APIv2
Enricher - VirusTotal APIv3
Enricher - Webroot
Incoming feeds
About incoming feeds
Access incoming feeds
Configure incoming feeds general options
Start and stop incoming feeds
About TLP overrides
Set half-life values
Set a schedule
Edit entities in an incoming feed
Reingest incoming feeds
About deleting incoming feeds
Delete incoming feeds
About purging incoming feeds
Purge incoming feeds
List of incoming feeds
Incoming feed - Advanced CSV
Incoming feed - AlienVault OTX Pulses Feed
Incoming feed - Amazon S3
Incoming feed - BFK
Incoming feed - Binary Defense Systems Artillery Threat Intelligence Feed
Incoming feed - Bitdefender Advanced Threat Intelligence
Incoming feed - Bitdefender Advanced Threat Intelligence Domain Feed
Incoming feed - Bitdefender Advanced Threat Intelligence Hash Feed
Incoming feed - Bitdefender Advanced Threat Intelligence IP Feed
Incoming feed - Cisco Threat Grid Curated Feed
Incoming feed - Cisco Threat Grid Samples API
Incoming feed - Cofense PhishMe Intelligence
Incoming feed - Crowdstrike Falcon X
Incoming feed - Crowdstrike Falcon X Indicator Feed
Incoming feed - Crowdstrike Falcon X Reports Feed
Incoming feed - Crowdstrike Falcon X Threat Actor Feed
Incoming feed - CVE Search API
Incoming feed - Cybercrime Tracker
Incoming feed - Cybercrime Tracker Domain Provider
Incoming feed - Cybercrime Tracker Zbot Provider
Incoming feed - Digital Shadows Searchlight Global Incidents Provider
Incoming feed - Digital Shadows Searchlight Private Incidents Provider
Incoming feed - Dragos Threat Feed
Incoming feed - EclecticIQ Intelligence Feeds
Incoming feed - EclecticIQ Commercial Sources Feed
Incoming feed - EclecticIQ Open Sources Feed
Incoming feed - FireEye iSIGHT Intelligence Report API
Incoming feed - Flashpoint
Incoming feed - Flashpoint Indicator Intelligence feed
Incoming feed - Flashpoint Intelligence Reports Provider
Incoming feed - FTP download
Incoming feed - Group-IB
Incoming feed - Group-IB APT Threat
Incoming feed - Group-IB Attacks Phishing
Incoming feed - Group-IB Attacks Phishing Kit
Incoming feed - Group-IB Brand Abuse Phishing Kit
Incoming feed - Group-IB Compromised Data Accounts
Incoming feed - Group-IB Compromised Data Cards
Incoming feed - Group-IB Human Intelligence Threat
Incoming feed - Group-IB Malware C2
Incoming feed - Group-IB Phishing Brand Abuse
Incoming feed - Group-IB Suspicious IP Socks Proxy
Incoming feed - HTTP download
Incoming - IMAP
Incoming feed - IMAP Email attachment and body fetcher
Incoming feed - IMAP email attachment fetcher
Incoming feed - IMAP email fetcher
Incoming feed - Intel 471 Adversary Intelligence Feed
Incoming feed - Intel 471 Malware Intelligence Reports Feed
Incoming feed - Intel 471 Vulnerability Intelligence
Incoming feed - Intel 471 Watcher Alerts
Incoming feed - IntSights Alerts
Incoming feed - JoeSandbox Analysis Feed
Incoming feed - Kaspersky Lab Threat Intelligence APT Reports
Incoming feed - Kaspersky Threat Intelligence
Incoming feed - Malwaredomains
Incoming feed - Microsoft Sentinel Alerts Feed
Incoming feed - MISP
Incoming feed - Mount point download
Incoming feed - NCFTA ListServ Intel
Incoming feed - NSFocus Provider
Incoming feed - NVD - Vulnerability Intelligence Feed
Incoming feed - OpenPhish
Incoming feed - Palo Alto Networks Auto Focus Threat Intelligence
Incoming feed - Palo Alto Autofocus Hash Feed 1
Incoming feed - Palo Alto PAN-OS Traffic Report
Incoming feed - Proofpoint Email Brand Defense
Incoming feed - Recorded Future feeds
Incoming feed - Recorded Future Analyst Note Feed
Incoming feed - Recorded Future Domain Feed
Incoming feed - Recorded Future Hash Feed
Incoming feed - Recorded Future IP Feed
Incoming feed - Recorded Future URL Feed
Incoming feed - Recorded Future Vulnerability Feed
Incoming feed - RSS version 2.0
Incoming feed - SFTP download
Incoming feed - Silobreaker
Incoming feed - SpyCloud Breach API
Incoming feed - SpyCloud Watchlist Ingest
Incoming feed - TAXII 2.1 poll
Incoming feed - TAXII inbox
Incoming feed - TAXII poll
Incoming feed - Threat Recon
Incoming feed - VirusTotal Provider
Incoming feed - VMRay Malware Submission Feed
Outgoing feeds
About outgoing feeds
Access outgoing feeds
Configure content types
Download outgoing feed created packages
Configure outgoing feeds general options
Start and stop outgoing feeds
Schedule for outgoing feeds
Set TLP filters for outgoing feeds
Set reliability and relevancy
Set observable filters for outgoing feeds
Include additional metadata
Anonymize data
Outgoing feeds reference
List of outgoing feeds
Outgoing feed - Amazon S3 push
Outgoing feed - Crowdstrike EDR
Outgoing feed - Cybereason
Outgoing feed - Email
Outgoing feed - Forcepoint
Outgoing feed - FTP upload
Outgoing feed - HTTP download feed
Outgoing feed - Infoblox NIOS
Outgoing feed - Microsoft Azure Sentinel Outgoing Feed
Outgoing feed - MISP
Outgoing feed - Mount point upload
Outgoing feed - Palo Alto PAN-OS External Dynamic List
Outgoing feed - SFTP upload
Outgoing feed - Syslog push
Outgoing feed - TAXII 2.1 push
Outgoing feed - TAXII inbox feed
Outgoing feed - TAXII poll feed
Outgoing feed - Zscaler Outgoing Feed
Apps
About apps
ArcSight
About the ArcSight integration
Get data from EclecticIQ Platform to ArcSight
Installation of Smart Connector(s)
Configure EclecticIQ Platform
Import the EclecticIQ base content package in ESM
Incoming events
EclecticIQ Platform connector field mappings
Create sightings and lookups from ArcSight to EclecticIQ Platform
CounterACT connector installation and configuration
Create Entity Command
Exchange data between platforms
Exchanging data between platforms
Create an automation role
Create an automation user
Create an automation group
Create a TAXII outgoing feed
Create a TAXII incoming feed
About ingestion discrepancies
IBM Resilient
Release notes - IBM Resilient integration
All release notes - IBM Resilient integration
Release notes - IBM Resilient integration 1.1.5
Release notes - IBM Resilient integration 1.1.3
Release notes - IBM Resilient integration 1.1.2
Release notes - IBM Resilient integration 1.0.3
About the IBM Resilient integration
Before you start with IBM Resilient
Install EclecticIQ Platform Integration
Configure EclecticIQ Platform Integration
Bootstrap EclecticIQ Platform Integration
Run resilient-circuits as a service
Configure manual sighting creation
Manually create sightings
Create artifacts and search for matches
Upgrade EclecticIQ Platform Integration
Uninstall EclecticIQ Platform Integration
Integrate with IBM QRadar
Release notes - IBM Qradar integration
Release notes - IBM QRadar integration 1.3.2
Release notes - IBM QRadar integration 1.3.3
Release notes - IBM QRadar integration 1.3.4
Release notes - IBM QRadar integration 1.3.5
About the QRadar integration
Install and Configure the app on QRadar
Upgrade the app on QRadar
Configure the QRadar app for Fusion Center
Work with the app on QRadar
Integrate with MISP
About MISP Integration
Incoming feed MISP
Outgoing EclecticIQ Platform MISP feed
Send events to a Syslog server
Splunk
Release notes - Splunk integration
Release notes - Splunk integration 2.3.1
Release notes - Splunk integration 2.4.0
Release notes - Splunk integration 2.5.0
Release notes - Splunk integration 2.5.1
Release notes - Splunk integration 2.5.2
Release notes - Splunk integration 2.5.3
Release notes - Splunk integration 2.5.4
Release notes - Splunk integration 2.5.5
About the Splunk integration
Get started with the Splunk integration
Working with the EclecticIQ Platform App for Splunk
Working with Splunk Enterprise Security
Work with EclecticIQ Fusion Center and Splunk
Splunk Phantom
Release notes - Splunk Phantom integration
Get started with the Splunk Phantom integration
EclecticIQ Browser Extension
Getting started
Find ingested entities
Manage observables and entities
Manage existing observables and entities
Regular expressions for extracting observables
EclecticIQ Integrations Life Cycle Policy
Release notes
All release notes
Release notes 2.12.1
Release notes 2.12.0
Release notes 2.11.4
Release notes 2.11.3
Release notes 2.11.2
Release notes 2.11.1
Release notes 2.11.0
Release notes 2.10.5
Release notes 2.10.4
Release notes 2.10.3
Release notes 2.10.2
Release notes 2.10.1
Release notes 2.10.0
Release notes 2.9.4
Release notes 2.9.3
Release notes 2.9.2
Release notes 2.9.1
Release notes 2.9.0
Release notes 2.8.0
Release notes 2.7.1
Release notes 2.7.0
Release notes 2.6.1
Release notes 2.6.0
Release notes 2.5.0
Release notes 2.4.0
Release notes 2.3.4
Release notes 2.3.3
Release notes 2.3.2
Release notes 2.3.1
Release notes 2.3.0
Release notes 2.2.1
Release notes 2.2.0.1
Release notes 2.2.0
Release notes 2.1.2
Security advisories
About dependency security patches
All security issues and mitigation actions
Security issues and mitigation actions
Archived security advisories
EIQ-2018-0001
EIQ-2018-0002
EIQ-2018-0003
EIQ-2018-0004
EIQ-2018-0005
EIQ-2018-0006
EIQ-2018-0007
EIQ-2018-0008
EIQ-2018-0009
EIQ-2018-0010
EIQ-2018-0011
EIQ-2018-0012
EIQ-2018-0013
EIQ-2018-0014
EIQ-2018-0015
EIQ-2018-0016
EIQ-2018-0017
EIQ-2018-0018
EIQ-2018-0019
EIQ-2018-0020
EIQ-2018-0021
EIQ-2018-0022
EIQ-2019-0001
EIQ-2019-0002
EIQ-2019-0003
EIQ-2019-0004
EIQ-2019-0005
EIQ-2019-0006
EIQ-2019-0007
EIQ-2019-0008
EIQ-2019-0009
EIQ-2019-0010
EIQ-2019-0011
EIQ-2019-0012
EIQ-2019-0013
EIQ-2019-0014
EIQ-2019-0015
EIQ-2019-0016
EIQ-2019-0017
EIQ-2019-0018
EIQ-2019-0019
EIQ-2019-0020
EIQ-2019-0021
EIQ-2019-0022
EIQ-2019-0023
EIQ-2019-0024
EIQ-2019-0025
EIQ-2019-0026
EIQ-2019-0027
EIQ-2019-0028
EIQ-2019-0029
EIQ-2019-0030
EIQ-2019-0031
EIQ-2019-0032
EIQ-2019-0033
EIQ-2019-0034
EIQ-2019-0035
EIQ-2019-0036
EIQ-2019-0037
EIQ-2019-0038
EIQ-2019-0039
EIQ-2022-0003
EIQ-2022-0002
EIQ-2022-0001
EIQ-2021-0017
EIQ-2021-0016-2
EIQ-2021-0016
EIQ-2021-0015
EIQ-2021-0014
EIQ-2021-0013
EIQ-2021-0012
EIQ-2021-0011
EIQ-2021-0010
EIQ-2021-0009
EIQ-2021-0008
EIQ-2021-0007
EIQ-2021-0006
EIQ-2021-0005
EIQ-2021-0004
EIQ-2021-0003
EIQ-2021-0002
EIQ-2021-0001
EIQ-2020-0016
EIQ-2020-0015
EIQ-2020-0014
EIQ-2020-0013
EIQ-2020-0012
EIQ-2020-0011
EIQ-2020-0010
EIQ-2020-0009
EIQ-2020-0008
EIQ-2020-0007
EIQ-2020-0006
EIQ-2020-0005
EIQ-2020-0004
EIQ-2020-0003
EIQ-2020-0002
EIQ-2020-0001
Support
Quick start guides
Share your ideas on the Ideas Portal
Troubleshooting
Broken dashboard gauges
Common proxy issues
Pushing content to a TAXII inbox shows no new content
Troubleshoot TAXII
Update stale half-life
Web browser certificate error
Hotfixes
EclecticIQ 2.5.0 hotfix 1
EclecticIQ 2.4.0 hotfix 1
Archive
Platform release 2.1.2
Platform release 2.1.1
Platform release 2.1
Platform release 2.0.2
Platform release 2.0.1
Platform release 1.14.4
Platform release 1.14.3
Platform release 1.14.2
Platform release 1.14.1
Platform release 1.14.0
Feedback
Profile