Set relationships

Relationships add intelligence value by describing how entities and observables are related. This information provides additional context, and it helps understand how a specific resource is used, or the purpose it serves for a potential attacker.
For example, it can clarify that an observable describes a vulnerability or a weakness that is related to its parent exploit target entity. Options vary based on the relationship the observable has with the specific entity type it belongs to. See About relationships for more information on relationships in the Intelligence Center.

There are two ways of adding relationships between entities:

  • In a graph

  • In an entity's neighborhood tab

These two ways are explained below.

Add a relationship in a graph

Add a relationship to a graph explains how to create relationships between entities while in a graph.

Add a relationship in the Neighborhood tab

On the Neighborhood tab you can update entity information by adding and removing entity relationships.

To do so, do the following:

  1. Under Directly related entities click Edit relationships.

  2. From the drop-down menu select the option corresponding to the relationship you want to create.

  3. On the Search an entity dialog, click the checkbox(es) to select one or more entities to relate them to the current one.

You can refine the displayed results by specifying a search string in the filter input field. Alternatively, click one of the available filter options to select and filter by specific:

  • Entity types

  • Source

  • Date

  • Datasets

  1. Click Select.

  2. From the Source drop-down menu, select a data source for the entity or entities you are relating to the current one. You can select only one data source at a time, regardless the number of entities you choose on the Search an entity dialog.

  3. Click Save to store your changes, or Cancel to discard them.

To remove a relationship or a relationship type, click the icon on the row displaying the relationship or next to the relationship type you want to remove.
The row and the corresponding relationship or the relationship type are removed. You cannot undo this action.

Set campaign relationships

Select this option…

… to create this relationship for the campaign

Associated Neighborhoods

Outgoing relationship — Relates the campaign to the selected campaign(s) on the Search an entitydialog.

Attributions

Outgoing relationship — Relates the campaign to the selected threat-actor(s) on the Search an entity dialog.

Related incidents

Outgoing relationship — Relates the campaign to the selected incident(s) on the Search an entitydialog.

Related TTPs

Outgoing relationship — Relates the campaign to the selected TTP(s) on the Search an entity dialog.

Indicator → Related campaigns

Incoming relationship — Relates the selected indicator(s) on the Search an entity dialog to the campaign.

Report Campaigns

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the campaign.

Threat actor Associated campaigns

Incoming relationship — Relates the selected threat-actor(s) on the Search an entity dialog to the campaign.

Sighting Campaign

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the campaign.

Set course of action relationships

Select this option…

… to create this relationship for the course of action

Related exploit targets

Outgoing relationship — Relates the course of action to the selected exploit target(s) on the Search an entity dialog.

Related incidents

Outgoing relationship — Relates the course of action to the selected incident(s) on the Search an entity dialog.

Related courses of action

Outgoing relationship — Relates the course of action to the selected course(s) of action on the Search an entity dialog.

Exploit target Potential courses of action

Incoming relationship — Relates the selected exploit target(s) on the Search an entity dialog to the course of action.

Indicator → Suggested courses of action

Incoming relationship — Relates the selected indicator(s) on the Search an entity dialog to the course of action. Recommends carrying out a course of action to respond to an indicator.

Incident Courses of action requested

Incoming relationship — Relates the selected indicator(s) on the Search an entity dialog to the course of action. Requests to carry out a course of action to respond to an incident.

Incident Courses of action taken

Incoming relationship — Relates the selected indicator(s) on the Search an entity dialog to the course of action. Reports the course of action carried out as a response to an incident.

Report Courses of action

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the course of action.

Sighting Course of action

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the course of action.

Set exploit target relationships

Select this option…

… to create this relationship for the exploit target

Potential courses of action

Outgoing relationship — Relates the exploit target to the selected potential course(s) of action on the Search an entity dialog

Related exploit targets

Outgoing relationship — Relates the exploit target to the selected exploit target(s) on the Search an entity dialog

Course of action → Related exploit targets

Incoming relationship — Relates the selected course(s) of action on the Search an entity dialog to the exploit target.

Report → Exploit targets

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the exploit target.

TTP → Exploit targets

Incoming relationship — Relates the selected TTP(s) on the Search an entity dialog to the exploit target.

Sighting → Exploit target

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the exploit target.

Set incident relationships

Select this option…

… to create this relationship for the incident

Related indicators

Outgoing relationship — Relates the incident to the selected indicator(s) on the Search an entitydialog.

Leveraged TTPs

Outgoing relationship — Relates the incident to the selected TTP(s) on the Search an entity dialog.

Attributed threat actors

Outgoing relationship — Relates the incident to the selected threat-actor(s) on the Search an entitydialog.

Related incidents

Outgoing relationship — Relates the incident to the selected incident(s) on the Search an entitydialog.

Courses of action requested

Outgoing relationship — Relates the incident to the selected course(s) of action on the Search an entity dialog to respond to the incident.

Courses of action taken

Outgoing relationship — Relates the incident to the selected course(s) of action on the Search an entity dialog that are carried out as a response to the incident.

Campaign → Related incidents

Incoming relationship — Relates the selected campaign(s) on the Search an entity dialog to the incident.

Course of action → Related incidents

Incoming relationship — Relates the selected course(s) of action on the Search an entity dialog to the incident.

Report Incidents

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the incident.

Sighting Incident

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the incident.

Edit indicator relationships

Select this option…

… to create this relationship for the indicator

Indicated TTPs

Outgoing relationship — Relates the indicator to the selected TTPs(s) on the Search an entity dialog.

Suggested courses of action

Outgoing relationship — Relates the indicator to the selected course(s) of action on the Search an entity dialog. Recommends carrying out a course of action to respond to the indicator.

Related Neighborhoods

Outgoing relationship — Relates the indicator to the selected indicator(s) on the Search an entitydialog.

Related campaigns

Outgoing relationship — Relates the indicator to the selected campaign(s) on the Search an entitydialog.

Incident → Related indicators

Incoming relationship — Relates the selected incident(s) on the Search an entity dialog to the indicator.

Report Indicators

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the indicator.

Sighting Indicator

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the indicator.

Set report relationships

Select this option…

… to create this relationship for the report

Indicators

Outgoing relationship — Relates the report to the indicator(s) on the Search an entity dialog.

TTPs

Outgoing relationship — Relates the report to the selected TTP(s) on the Search an entity dialog. Recommends carrying out a course of action to respond to the report.

Exploit targets

Outgoing relationship — Relates the report to the selected exploit target(s) on the Search an entitydialog.

Incidents

Outgoing relationship — Relates the report to the selected incident(s) on the Search an entity dialog.

Courses of action

Outgoing relationship — Relates the report to the selected course(s) of action on the Search an entity dialog.

Campaigns

Outgoing relationship — Relates the report to the selected campaign(s) on the Search an entitydialog.

Threat actors

Outgoing relationship — Relates the report to the selected threat actor(s) on the Search an entitydialog.

Sighting Neighborhood

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the report.

Set sighting relationships

Select this option…

… to create this relationship for the sighting

Campaign

Outgoing relationship — Relates the sighting to the selected campaign(s) on the Search an entitydialog.

Course of action

Outgoing relationship — Relates the sighting to the selected course(s) of action on the Search an entity dialog.

Exploit target

Outgoing relationship — Relates the sighting to the selected exploit target(s) on the Search an entitydialog.

Indicator

Outgoing relationship — Relates the sighting to the selected indicator(s) on the Search an entitydialog.

Incident

Outgoing relationship — Relates the sighting to the selected incident(s) on the Search an entitydialog.

Report

Outgoing relationship — Relates the sighting to the selected report(s) on the Search an entity dialog.

Threat actor

Outgoing relationship — Relates the sighting to the threat actor(s) on the Search an entity dialog.

TTP

Outgoing relationship — Relates the sighting to the selected TTP(s) on the Search an entity dialog.

Set threat actor relationships

Select this option…

… to create this relationship for the threat actor

Observed TTPs

Outgoing relationship — Relates the threat actor to the selected TTP(s) on the Search an entitydialog.

Associated campaigns

Outgoing relationship — Relates the threat actor to the selected campaign(s) on the Search an entitydialog.

Associated actors

Outgoing relationship — Relates the threat actor to the selected threat actor(s) on the Search an entity dialog.

Campaign Attributions

Incoming relationship — Relates the selected campaign(s) on the Search an entity dialog to the threat actor.

Incident → Attributed threat actors

Incoming relationship — Relates the selected incident(s) on the Search an entity dialog to the threat actor.

Report → Threat actors

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the threat actor.

Sighting Threat actor

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the threat actor.

Set TTP relationships

Select this option…

… to create this relationship for the TTP

Exploit targets

Outgoing relationship — Relates the TTP to the selected exploit target(s) on the Search an entitydialog.

Related TTPs

Outgoing relationship — Relates the TTP to the selected TTP(s) on the Search an entity dialog.

Campaign → Related TTPs

Incoming relationship — Relates the selected campaign(s) on the Search an entity dialog to the TTP.

Indicator → Indicated TTPs

Incoming relationship — Relates the selected indicator(s) on the Search an entity dialog to the TTP.

Incident → Leveraged TTPs

Incoming relationship — Relates the selected incident(s) on the Search an entity dialog to the TTP.

Report → TTPs

Incoming relationship — Relates the selected report(s) on the Search an entity dialog to the TTP.

Threat actor Observed TTPs

Incoming relationship — Relates the selected threat actor(s) on the Search an entity dialog to the TTP

Sighting → TTP

Incoming relationship — Relates the selected sighting(s) on the Search an entity dialog to the TTP.