Identity#

Tip

This entity is analogous to these STIX objects:

STIX 2.1 §4.5 Identity SDO

Compatibility:

Not ingested by EclecticIQ Intelligence Center 2.14.
Not compatible with STIX 1.2.

Create an Identity entity by selecting:

In the side navigation bar + Create > Identity.

Or:

(Requires EclecticIQ Labs: Intelligence creation on the graph)

In the top navigation bar of a graph, select + and then select one of the following to create a draft entity:
- Identity individual: Creates an Identity entity with its Identity class set to Individual.
- Identity group: Creates an Identity entity with its Identity class set to Group.
- Identity system: Creates an Identity entity with its Identity class set to System.
- Identity organization: Creates an Identity entity with its Identity class set to Organization.
- Identity individual: Creates an Identity entity with its Identity class set to Individual.
- Identity class: Creates an Identity entity with its Identity class set to Class.
- Identity generic: Creates an Identity entity with its Identity class set to Generic.
Double-click to open the newly created draft entity to edit it.

Then, Configure this entity.

Configure#

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General#

Field	EIQ JSON field	Description
Title*	`data.title`	Descriptive title for this entity. See Titles and aliases.
Analysis	`data.description`	Long description.
Identity class*	`data.identity_class`
Roles	`data.roles[]`	Free-form text. From STIX 2.1 §4.5 Identity SDO : The list of roles that this Identity performs (e.g., CEO, Domain Administrators, Doctors, Hospital, or Retailer). No open vocabulary is yet defined for this property.
Sectors	`data.sectors[]`	Based on STIX 2.1 §10.11 Industry Sector Vocabulary.
Confidence	`data.confidence`	See Confidence scale: High Medium low.

Characteristics: Specification#

Add one or more items to Specification to flesh out the identity being described. Content here is used to construct the XML content in the data.identity_specification.specification_xml field in EIQ JSON. Based on STIXCIQIdentity3.0Type as used in CIQIdentity3.0InstanceType/ CIQ 3.0 Specifications.

When exported as a STIX 2.1 Identity SDO, this XML is exported as the contents of the contact_information field.

Field	Description
Account	Describes a bank account or similar. Available fields: *Account type: Set an account type. Free text field. Account status:* Set an account status. Free text field. Account specification: Add one or more account specifications. For each account specification, set these fields: *Type: One of the following options: Account ID Issuing authority Account type Account branch Issuing country name Value:* Set a value for this account specification.
Person	Add one or more properties describing a person. *Type: Select one of these options: Preceding title Title First name Middle name Last name Other name Alias name Generation identifier Degree Value:* Enter a value for this Type.
Organization	Add one or more properties describing an organization. *Type: Select one of these options: Name only Type only (i.e. “Inc”) Full name Value:* Enter a value for this Type.
Electronic address	Add one or more electronic addresses for this targeted victim. *Type: Select an electronic address type. Value:* Enter the full electronic address.

Each item added to the Specification section creates an observable with the corresponding type:

Specification field	Resulting observable type(s)
Account	`bank-account`
Person	`person`
Organization	`organization`
Electronic address	`email` `domain` `handle`

Observables#

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	`extracts[].kind`	See Observable types
Link name*	See Observable link types	See Observable link types
Values(s)*	`extracts[].value`	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Relationships#

Add relationships to this entity by selecting + Add relationship.

See Relationships.

Meta#

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Estimated threat start time	`meta.estimated_threat_start_time`	Estimated start of threat. See Time values.
Estimated threat end time	`meta.estimated_threat_end_time`	Estimated end of threat. See Time values.
Estimated observed time	`meta.estimated_observed_time`	Estimated time threat was observed. See Time values.
Half-life	`meta.half_life`	See Half-life. Select one of these options: Use default value: When selected, half-life for this entity is set to 720 days. Override value: Set a custom value for half-life, in number of days.
Tags	`meta.tags[]` and `meta.taxonomy_paths[]`	See tags and taxonomies.
Source*	`sources[]`	Select one source.
Source reliability	`meta.source_reliability`	See source reliability. Options: Inherit from source: This entity inherits source reliability from Source. Custom override: Set a source reliability value for just this entity.

Information source#

Field	EIQ JSON field	Description
Description	`data.information_source.description`	Description of information source.
Identity	`data.information_source.identity`	Name of this information source
Roles	`data.information_source.roles[]`	One or more information source roles. Possible values: Initial Author Content Enhancer/Refiner Aggregator Transformer/Translator
References	`data.information_source.references[]`	One or more URLs.

Data marking#

Descriptive metadata for entity.

Field	EIQ JSON field	Description
TLP	`meta.tlp_color`	Set a TLP color for this entity.
Terms of use	`data.handling[].marking_structures[]`	Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.
Simple	`data.handling[].marking_structures[]`	Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow#

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.
Manually enrich	Run one or more enrichers on this entity on Publish.

Save and publish#

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.