Create entities from observables#
Observables depend on entities to provide context. You can create these entities when working with observables:
Indicators
Sightings
To create an entity from observables:
In the Observables view
In the left navigation bar, go to Search > GO SEARCH AND BROWSE > Browse > Observables.
Select the menu icon in the row corresponding to the observable you want to convert to a sighting.
From the drop-down menu select Create sighting or Create indicator.
This creates a new entity, with the selected observables automatically added.
In the Observables detail pane
In the left navigation bar, go to Search > GO SEARCH AND BROWSE > Browse > Observables.
Select anywhere in the row corresponding to the observable you want to convert to a sighting.
From the drop-down menu select Create sighting or Create indicator
This creates a new entity, with the selected observables automatically added.
In the Observables tab on the entity detail pane
Open the entity detail pane of the entity related to the observable you want to convert to a sighting.
In the entity detail pane, select the Observables tab.
From the drop-down menu select Create sighting or Create indicator
This creates a new entity, with the selected observables automatically added.
Bulk action on multiple observables
You can also select multiple observables, and then you can convert them to sightings at once:
Browse to the Observables view or open the Observables tab in the entity detail pane of the entity whose observables you want to convert to sightings.
Select the checkboxes corresponding to the observables you want to convert to sightings.
Select the menu icon above the table header, and from the drop-down menu select Create sighting or Create indicator.
This creates a new entity, with the selected observables automatically added.