Add entities to a graph#

There are several ways to add an entity to a graph:

  • In a graph: create a draft entity in the graph.

  • In a graph: add a published entity to the graph.

  • In a published entity: using Add to graph from the actions menu.

  • In a published entity: from the Neighborhood tab.

Each method is explained below.

Create a draft entity while in a graph#

Note

Beta feature: Go to Settings Settings> System settings and select Beta features > Enable intelligence creation on the graph.

When you are working on a graph, you can create draft entities on the fly without leaving the graph canvas. You can recognize a draft entity by the dashed circle around it.

Tip

Use this method to add draft entities to saved or unsaved graphs.

To create a draft entity in a graph:

  1. Click + in the top navigation bar.

  2. Select the entity type you want.

  3. Give the entity a name.

The entity is created as a draft entity.

  • To edit the entity’s details, double-click its icon.

  • To publish the entity, click |icon-publish| in the top navigation bar.

Add a published entity while in a graph#

When you are working on a graph, you can add published entities on the fly without leaving the graph canvas.

Tip

Use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to a graph:

  1. Click Search icon (add from Search), Eye (add from Discovery), or Workspaces icon (add from Workspaces).

  2. (Optional) Filter visible entities by selecting Filter.

    Select options from the following dropdown menus to filter visible entities:

    • Entity type: select one or more checkboxes to load to the graph only the specified entity types.

    • Source: select one or more checkboxes to load to the graph only entities belonging to the specified data sources.

    • TLP: select one or more checkboxes to load to the graph only entities with specific TLP color-codes.

    • Date: select a time interval to load to the graph only entities ingested between the specified start and end dates.

    • Dataset: select one or more checkboxes to load to the graph only entities belonging to the specified datasets.

      The option to filter by dataset is only available when the current view or the results include entities belonging to at least one dataset

  3. After selecting the entities to add to the graph, in the bottom-right corner click Add to graph.

Add a published entity from its actions menu#

When you are working in a published entity’s detail pane, you can add add it to a graph using its actions menu.

Tip

Use this method to add an entity to the currently open graph.

You can use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to a graph using the entity’s actions (More) menu:

  1. Locate the entity you want in one of the following ways:

    1. In the top navigation bar click Search Search icon > GO TO SEARCH AND BROWSE, Discovery or Exposure.

    2. In the top navigation bar click Data configuration > Incoming feeds > ${incoming_feed_name} > Entities.

  2. Click the entity.

  3. In the top-right corner click More.

  4. From the drop-down menu select Add to graph.

To see if the entity has been loaded to the currently open graph, hover the mouse pointer over Create graph in the side navigation bar to display a thumbnail view of the current graph canvas.

Add a published entity from its Neighborhood tab#

When you are working in a published entity’s detail pane, you can add add it to a graph using its Neighborhood tab.

Tip

Use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to either a graph using the entity’s Neighborhood tab:

  1. Locate the entity you want in one of the following ways:

    1. In the top navigation bar click Search Search icon > GO TO SEARCH AND BROWSE, Discovery or Exposure.

    2. In the top navigation bar click Data configuration > Incoming feeds > ${incoming_feed_name} > Entities.

  2. Click the entity.

  3. Click the Neighborhood tab.

  4. In the Neighborhood tab, click CREATE IN NEW GRAPH or LOAD IN OPEN GRAPH.

  5. The graph canvas opens to show the entire content of the selected graph.

To see if the entity has been loaded to the currently open graph, hover the mouse pointer over Create graph in the side navigation bar to display a thumbnail view of the current graph canvas.