Entity versions

The Versions tab displays an overview in reverse chronological order of the available versions of the entity in the Intelligent Center.

When an entity is updated, modified or edited, the Intelligent Center creates a new version of the entity to reflect the changes. Over time, multiple versions of an entity can exist in the Intelligent Center.

Entity versioning is based on STIX versioning:

• Minor version: based on STIX incremental updates, it introduces minor updates to the content of the entity or its nested observables.

  • It does not change the STIX id of the entity.

  • It updates the timestamp field.

• Major version: based on STIX major updates, it introduces content updates that change the role, the function, or the representation of the entity.

  • It creates a new STIX id for the entity.

  • It updates the timestamp field.

  • It establishes a relationship to link the new version of the entity with the previous one.

To review the version list of an entity:

• Click the Versions tab to display an overview in reverse chronological order of any existing versions of the entity, along with the corresponding data source — an incoming feed, an enricher or a group — a TLP color code, if available, and the creation date and time.

• Click an entity version name to display the corresponding information on the detail pane, where you can modify and edit it, if necessary.

The most recent version of the entity is the active one.

Older versions exist to document the history of the entity and to act as reference.

Therefore, most actions you can normally carry out on an entity are disabled and grayed out on the Actions menu.

The Intelligent Center notifies you when an entity version is obsolete:

• If you click an outdated entity version name, the corresponding entity detail pane is displayed.

• In the detail pane menu , most actions are grayed out (disabled).

• A message notifies you about the version being outdated.