Sighting#

A sighting describes a specific occurrence of an indicator or an observable.

Create a sighting by selecting:

In the side navigation bar + Create > Sighting.

Or:

(Requires Beta: Intelligence creation on the graph)

In the top navigation bar of a graph, select + and then Sighting to create a draft entity.
Double-click to open the newly created draft entity to edit it.

Then, Configure this sighting.

Configure#

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General#

Field	EIQ JSON field	Description
Title*	`data.title`	Descriptive title for this entity. See Titles and aliases.
Analysis	`data.description`	Long description of indicator. Use this to contain unstructured information about this indicator.
Confidence	`data.confidence`	Confidence in the accuracy and trustworthiness of the information contained by this entity. Analogous to ConfidenceType. Possible values from Enumerated values: High Medium low.
Impact	`data.impact`	Describes the severity of the likely impact this indicator has in a given context. Possible values from Enumerated values: High Medium low.

Characteristics#

Characteristics are properties on an entity that provide context for the intelligence indicated by this object.

The following are characteristics available for sightings:

Security Control
Raw Events
Related Observables

Characteristics: Security Control#

Security controls describe the tools, systems, equipment, processes, and procedures that are in place to manage and protect the confidentiality, integrity, and availability of the system and its data.

These fields are available:

Identity

Field	EIQ JSON field	Description
Name	`data.raw_events`	Name of security control.

Time

Field	EIQ JSON field	Description
Start	`data.security_control.time_start`	Start of validity.
Start precision	`data.security_control.time_start_precision`	Date and time precision of start of validity.
End	`data.security_control.time_end`	End of validity.
End precision	`data.security_control.time_end_precision`	Date and time precision of end of validity.
Received	`data.security_control.time_received`	End of validity.
Received precision	`data.security_control.time_received_precision`	Date and time precision of end of validity.

References

Field	EIQ JSON field	Description
Reference back URL	`data.security_control.references`	Enter one or more URLs.

Characteristics: Raw Events#

Add raw event data to this sighting.

Field	EIQ JSON field	Description
Raw events*	`data.raw_events`	Free text field.

Characteristics: Related Observables#

Add one or more observables to this sighting.

Note

This creates observables without link names.

You may want to use Add observables to create observables instead.

Field	EIQ JSON field	Description
Kind*	`extracts[].kind`	See observable types.
Value*	`extracts[].value`	Value of observable.

When the sighting is published, observables added here are visible in the Observables tag.

Observables#

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	`extracts[].kind`	See Observable types
Link name*	See Observable link names	See Observable link names
Values(s)*	`extracts[].value`	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Relations#

Add relationships to this entity by selecting + Relationship.

From the drop-down menu, select an entity type to create a relationship to.
After selecting an option, the Search an entity dialog appears. Select one or more entities to relate to the current entity.

Note

You can narrow down the displayed entities by entering a search query, or by using the filter .
Select Select to add the selected entities as relations.

Once a relationship is added to this entity, you can:

Assign MITRE ATT&CK IDs by selecting + under the MITRE ATT&CK IDs column.
Set a Relationship type
- Enter a custom relationship type by typing in the empty field and pressing ENTER to save.
- Select one of these options:
  - Indicates malware
  - Is associated campaign to
  - I don’t know
  - Could be anything

Meta#

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Estimated threat start time	`meta.estimated_threat_start_time`	Estimated start of threat. See Time values.
Estimated threat end time	`meta.estimated_threat_end_time`	Estimated end of threat. See Time values.
Estimated observed time	`meta.estimated_observed_time`	Estimated time threat was observed. See Time values.
Half-life	`meta.half_life`	See Half-life. Select one of these options: Use default value: When selected, half-life for this entity is set to 720 days. Override value: Set a custom value for half-life, in number of days.
Tags	`meta.tags[]` and `meta.taxonomy_paths[]`	See tags and taxonomies.
Source*	`sources[]`	Select one source.
Source reliability	`meta.source_reliability`	See source reliability. Options: Inherit from source: This entity inherits source reliability from Source. Custom override: Set a source reliability value for just this entity.

Data marking#

Descriptive metadata for entity.

Field	EIQ JSON field	Description
TLP	`meta.tlp_color`	Set a TLP color for this entity.
Terms of use	`data.handling[].marking_structures[]`	Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.
Simple	`data.handling[].marking_structures[]`	Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow#

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.
Manually enrich	Run one or more enrichers on this entity on Publish.

Save and publish#

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.