Add observables to a graph

There are several ways to add observables to a graph:

• In a graph: create a draft observable in the graph itself

• In the Browse view

Add observables in the graph itself

Note

EclecticIQ Labs: Go to Settings > System settings and select EclecticIQ Labs > Enable intelligence creation on the graph.

To create a draft entity in a graph:

1. Click + in the top navigation bar.

2. Select Observable in the dropdown list.

3. In Add observables, fill out these fields:

   Field name	Description
   Type*	Select an observable type.
   Value*	Enter a value for this observable. This acts as the name for the observable, and represents the observed value.
   Maliciousness*	Select a maliciousness value for this observable.

4. Click Save.

Add observables to a graph in the Browse view

To add an observable to the last opened graph:

1. Find an observable to load. Go to Search > GO TO SEARCH AND BROWSE > Observables.

2. Locate the observable in the list, and select More on the far right of that entry.

3. Select Add to graph.

   This adds the observable to the last graph you worked on.

To add multiple observables to the last opened graph

1. Find observables to load. Go to Search > GO TO SEARCH AND BROWSE > Observables.

2. Select more than one observable from the list.

3. In the horizontal bar that appears, select Add to > Graph.

   This adds the observable to the last graph you worked on.