Manage observables

Access observables

You can access observable details in one of the following ways:

Through the observable detail pane

1. In the left navigation bar, go to either:

   • Search > GO TO SEARCH AND BROWSE > Observables, or

   • Create + > VIEW PRODUCTION > Observables.

2. Select an observable to open it.

Through the Observable tab in the entity detail pane

1. Go to Search > GO TO SEARCH AND BROWSE > Entities.

2. Select an entity to open it.

3. In the entity detail pane, select the Observables tab to display an overview listing any observables related to the entity.

4. Select an observable from that list to open it.

Edit observables

Observables are immutable objects on EclecticIQ Intelligence Center. You cannot edit them directly.

Instead:

• (EclecticIQ Labs) Edit a draft observable. See Edit observables in a graph.

• Edit Observable maliciousness.

• Run enrichers on observables.

Remove observables from entity

Entities have a list of directly related observables displayed in the Observables tab.

Removing an observables from this list:

• removes direct relation between the entity to the observable

• retains the observable in EclecticIQ Intelligence Center.

To permanently remove an observable from EclecticIQ Intelligence Center, see Delete observables.

Delete and ignore observables

• Delete an observable to remove it permanently from EclecticIQ Intelligence Center.

• Delete and ignore an observable to remove it permanently from EclecticIQ Intelligence Center, and prevent it from subsequently being ingested. See Ignore observables.

Delete from a graph

1. In a graph, select one or more observables.

2. Right-click your selection.

3. Select Delete from the platform.

Delete from Browse and Production

1. In the left navigation bar, go to Search > GO TO SEARCH AND BROWSE > Observables.

2. Locate the observable to delete. On the right of it, select More > Delete.

   Or:

   1. Select the observable to open it.

   2. In the detail pane, select More > Delete.