Edit entities

Edit entities to update their information, and to keep their intelligence value in sync with the real-life threat elements they model.

About editing entities

You can open the entity editor to modify or to update entity information from almost anywhere in the Intelligence Center with a couple of clicks.

For quick edits on the fly, you can bypass the editor and apply inline edits in the entity detail pane.

You may need to edit entities to keep their information accurate and reliable over time. At the same time, you want to keep the original intelligence as it was ingested into the Intelligence Center. Besides the original entity, you want to be able to browse the entity change history; for example, to inspect how the entity changed and evolved over time, or who introduced specific changes at a certain point in time. Versioning takes care of that.

About entity versions

Saving changes to an entity produces a new version of the entity.
When you edit an entity and save the changes, the Intelligence Center creates a new version of the entity with the changes, and it archives the previous version without the changes.

For example, if you edit the TLP value of an entity, or if you assign a TLP override value to an entity, the update produces a new version of the entity.

• The new version receives a new Intelligence Center ID, it is published to the Intelligence Center, and it becomes the current version of the entity.

• The previous version is not editable and not searchable. It is obsolete, and it remains available for reference.

Obsolete entity versions are flagged as outdated.
You can click an entity version name to view the corresponding details, to export it as JSON or STIX, to add it to a dataset, or to delete it.
Other actions are disabled in as outdated entities.

To view a list of all existing versions of an entity open the entity detail pane, and then click Versions.

About editing entity data sources

When the Intelligence Center ingests duplicate data, it updates existing entities to add the origin of the duplicate data as a new data source.
When changes to the data sources for an entity occur – for example, adding a new data source, renaming an enricher, or deleting an incoming feed – the process triggers entity and observable rules that use the changed data sources as a criterion:

• The current data sources of the affected entities are reassessed.
  For example, any unavailable sources, such as a deleted incoming feed, are dropped; new sources, such as the origin of a discarded duplicate package, are added.

• The timestamp recording the most recent entity update is set to now; that is, the time the data source change occurs.

• Entity and observable rules are triggered to update any entity information that may have changed because of the data source modification.

About non-editable entities

If the Edit option is grayed out, it is not available for the selected entity.
It is not possible to edit entities in the following cases:

• The entity is outdated (meta.is_outdated_version: true).
  Obsolete entity versions are flagged as outdated.
  You can view an outdated entity, export it as JSON or STIX, add it to a dataset, or delete it.
  Other actions are disabled.

• The entity is unresolved, because it is a only a pointer to external reference (meta.is_unresolved_idref: true).
  Unresolved entities contain an idref pointing to external data.
  They are placeholders for the external data they refer to, and they do not hold any other information.

• The entity is associated with a draft copy (entity.meta.draft_id).
  To edit the entity, you must first either publish the associated draft, or delete it.

Edit entities

Edit entities on the fly

In the entity detail pane you can edit some entity details without opening the editing editor, and without having to manually save your changes.
This is a time-efficient option to implement quick updates to only one or two editable fields.

You can apply in-pane, on-the-fly edits to the following entity fields:

• Title

• Tags

• Estimated threat start time

• Estimated threat end time

• Estimated observed time

• Half life

• Source reliability

Edit entities on the fly

To apply quick on-the-fly edits to an entity:

• Open the detail pane of the entity you want to edit.

• In the selected entity detail pane, click the edit icon next to the field you want to update.

• Apply the changes as needed.

• To store your changes, click Save; to discard them, click Cancel.

Besides the fields where the edit icon is available, you can edit on the fly also the title, the TLP value, and the tags of an entity.

Edit entity alias on the fly

To edit an entity title:

• In the entity detail pane, click anywhere in the title field.

• Click Edit.

• In the Edit entity alias pop-up dialog input field, change the title as needed.

• To store your changes, click Save; to discard them, click Cancel.

This action creates an entity title alias: the newly applied changes become the current title of the entity, whereas the original entity title is stored as Original title.
Subsequent changes to the entity alias are not recorded.
To restore the original title of the entity, delete the content of the alias.

Entity aliases are useful to rename reader-unfriendly titles of ingested entities, usually automatically generated, to friendlier and more memorable titles.

Edit TLP on the fly

To edit the TLP value:

• In the entity detail pane, click anywhere in the TLP field.

• In the Override TLP pop-up dialog, from the drop-down menu select a different TLP color.

• To store your changes, click Save; to discard them, click Cancel.

Edit entities in the detail pane

In the entity detail pane you can apply more extensive edits to entity details by opening the in-pane entity editor.
This approach avoids focus switching: it keeps you focused in the current area, instead of directing – and distracting – you to the entity editor in a new view.

To edit an entity in the detail pane:

• Select and click the entity to edit in a view such as Browse, Production, Exposure, Production, or from the Entities section of a workspace dashboard.

• To open the in-pane entity editor, in the entity detail panel click the edit icon .
  Alternatively:
  In the entity detail panel click the menu icon , and from the drop-down menu select Edit.

To change the view from the in-pane entity editor to the corresponding full page view:

• In the entity detail panel click .
  This action produces the following result:

  • The currently active entity editor is opened in full page view in a new browser tab.

  • The corresponding in-pane entity editor is closed.

Edit from the menu

1. In the active view, browse to the entity you want to edit.

2. Click the menu icon in the row corresponding to the entity you want to edit.

3. From the drop-down menu select Edit.

   The entity editor opens, and you can start editing the entity content in the form fields as needed.

Edit entities in Browse

1. In the top navigation bar click Browse.

   All the available entities are displayed.

2. To narrow down the results in the view, select one or more quick filter options, as needed.

   • Entity: select one more entity types you want to see.

   • Source: this lists the source the entity is derived from.
     Select one more sources to filter the display.

   • TLP: filter based on the Traffic Light Protocol.

   • Date: filter using a date range for entity creation.

   • Dataset: filter using a dataset.

Edit entities in Discovery

1. In the left navigation bar, go to Discovery .
   All the available entities are displayed.

2. To narrow down the results in the view, select one or more quick filter options, as needed.

   • Entity: select one more entity types you want to see.

   • Source: this lists the source the entity is derived from.
     Select one more sources to filter the display.

   • TLP: filter based on the Traffic Light Protocol.

   • Date: filter using a date range for entity creation.

   • Reliability: filter the entities by reliability.
     This is set while creating the entity based on how reliable the source is.

   • Discovery rules: if you have set any discovery rules, you can filter the entities using the Discovery filter.

   • Dataset: filter using a dataset.

3. In the active view, browse to the entity you want to edit, and click it.

4. You can then proceed to edit the entity in one of the following ways:

   1. Open the entity detail pane and select > Edit, or

   2. Apply inline edits on the fly on the entity detail pane.

Edit entities in Exposure

1. In the left navigation bar, go to Exposure .

2. On the Exposure view click the Entities tab to display an overview of currently exposed entities.
   

   To sort items by column header:

   1. Click the header of the column whose content you want to sort.

   2. Click or to sort the content in either ascending or descending order, respectively.

   To show and to hide the available quick filters in the current view click .

   1. Click the Entities tab.

   2. Click .
      The following filters are provided:

   • Entity: select one or more checkboxes to view exposure details for the specified entity types.

   • Date: select a time interval to view exposure details for the entities ingested between the specified start and end dates.

   • Dataset: select one or more checkboxes to view exposure details for entities that relate to the specified datasets.

     The Dataset filter is not available if results do not include entities that relate to at least one dataset.

   You can stack and combine as many filters as you need. For example, you can create a filter to view exposure details for indicators that belong to the X, Y, and Z datasets that were ingested in the first half of last month.

3. In the active view, browse to the entity that you want to edit and edit the entity in one of the following ways:

   • Select the edit option in the context menu.

   • Open the entity detail pane, and select Actions > Edit.

   • Apply inline edits in the entity detail pane.

   For more information, see Edit entities.

Edit entities in a workspace

1. In the left navigation bar, go to Workspaces .

2. In the workspace view, click the desired workspace to open it.

3. In the Entities section, click the entity you want to edit.

4. You can then proceed to edit the entity in one of the following ways:

   1. Select the corresponding option in the context menu, or

   2. Open the entity detail pane and select > Edit, or

   3. Apply inline edits on the fly on the entity detail pane.

5. If you are working on a graph, double-click the entity you want to edit and:

   1. In the entity detail pane click > Edit, or

   2. Apply inline edits on the fly on the entity detail pane.

Edit entities in the graph

1. On the graph double-click the entity you want to edit.

2. You can then proceed to edit the entity in one of the following ways:

   1. On the entity detail pane click > Edit, or

   2. Apply inline edits on the fly on the entity detail pane.

Edit entities in an incoming feed

1. In the left navigation bar, go to Data configuration > Incoming feeds to display the incoming feed list.

2. Click anywhere in the row corresponding to the incoming feed containing the entity you want to edit.

3. Open the entity detail pane and select > Edit, or

4. In the feed detail pane click the Entities tab.

5. In the active view, browse to the entity you want to edit, and click it.

6. Apply inline edits on the fly on the entity detail pane.

Edit entities in a dataset

1. In the left navigation bar, go to Data configuration > Datasets to display a list of all datasets.

2. Click anywhere in the row corresponding to the dataset containing the entity you want to edit.

3. You can then proceed to edit the entity in one of the following ways:

   1. Select the corresponding option in the context menu, or

   2. Open the entity detail pane and select > Edit, or

   3. Apply inline edits on the fly on the entity detail pane.

Edit uploaded entities

1. In the left navigation bar, go to Search > GO TO SEARCH AND BROWSE > Files.
   You can edit only entities that are part of successfully uploaded files whose upload status is successful .

2. Click the menu icon in the row corresponding to the uploaded file originally containing the entity you want to edit.

3. From the drop-down menu select View.
   The page displays a list with the entities ingested through the uploaded file.

4. In the active view, browse to the entity you want to edit.

5. You can then proceed to edit the entity in one of the following ways:

   • Select the corresponding option in the context menu, or

   • Open the entity detail pane and select > Edit, or

   • Apply inline edits on the fly in the entity detail pane.

You can manually edit entities ingested as a result of a manual file upload operation:

1. In the left navigation bar, go to Search > GO TO SEARCH AND BROWSE > Files.
   You can edit only entities that are part of successfully uploaded files whose upload status is successful .

2. Click the menu icon in the row corresponding to the uploaded file originally containing the entity you want to edit.

3. From the drop-down menu select View.

4. The view lists the entities ingested through the uploaded file.

5. In the active view, browse to the entity you want to edit.

6. You can then proceed to edit the entity in one of the following ways:

   • Click the menu icon in the row corresponding to the entity you want to edit, and then click Edit.

   • Open the entity detail pane, click the menu icon , and then select Edit.

   • Apply inline edits on the fly in the entity detail pane.

Save options

To store your changes, click Save; to discard them, click Cancel.
To access additional save options, click the down arrow on the Save button:

• Click Save draft to store your changes without publishing the entity.

• Click Publish to release the new version of the entity that includes your changes.

• Click Cancel to discard the changes.

Save a draft

Drafts are available in the entity editor under Draft entities.

Two additional options are available when saving an entity as a draft:

• Click Save draft and new if you are creating a new entity and have not saved it before. This option saves the current populated form as a draft without publishing it to the Intelligence Center, and creates and opens a new draft form in the editor.

• Click Save draft and duplicate to the current populated form as a draft without publishing it to the Intelligence Center, and create and opens a prepopulated copy of the draft entity in the editor to speed up the creation of a new entity of the same type.

Publish an entity

Published entities are saved to the Intelligence Center.
When the new entity is indexed, it is available in the Intelligence Center, in the entity editor under Published.
Published entities associated with a workspace or included in a dataset are available also through the corresponding workspace and dataset.

Two additional options are available when publishing an entity:

• Click Publish and new if you are creating a new entity and you have not published it before. This option saves the current populated form, publishes it to the Intelligence Center, and creates and opens a new form in the editor.

• Click Publish and duplicate to save the current populated form, publish it to the Intelligence Center, and create and open a prepopulated copy of the newly published entity in the editor to speed up the creation of a new entity of the same type.