Add observables to a graph#

There are several ways to add observables to a graph:

  • In a graph: create a draft observable in the graph itself

  • In the Browse view

Add observables in the graph itself#

Note

EclecticIQ Labs: Go to Settings Settings> System settings and select EclecticIQ Labs > Enable intelligence creation on the graph.

To create a draft entity in a graph:

  1. Click + in the top navigation bar.

  2. Select Observable in the dropdown list.

  3. In Add observables, fill out these fields:

    Field name

    Description

    Type*

    Select an observable type.

    Value*

    Enter a value for this observable. This acts as the name for the observable, and represents the observed value.

    Maliciousness*

    Select a maliciousness value for this observable.

  4. Click Save.

Add observables to a graph in the Browse view#

To add an observable to the last opened graph:

  1. Find an observable to load. Go to Search Search icon > GO TO SEARCH AND BROWSE > Observables.

  2. Locate the observable in the list, and select More More on the far right of that entry.

  3. Select Add to graph.

    This adds the observable to the last graph you worked on.

To add multiple observables to the last opened graph

  1. Find observables to load. Go to Search Search icon > GO TO SEARCH AND BROWSE > Observables.

  2. Select more than one observable from the list.

  3. In the horizontal bar that appears, select Add to > Graph.

    This adds the observable to the last graph you worked on.