Relationships#

Relationships are objects that allow you to describe how one entity is related to another.

Tip

From 3.0, relationships have been changed. See Compatibility.

Create relationships#

Tip

Additional options such as selecting a relationship type or direction are only available when you Edit relationships.

While creating an entity, you can add relationships between the entity being created and existing entities.

You can create relationships between entities in the following ways:

  • When creating entities, go to the Relationships section of the Create pane and select + Add relationship.

  • Open an entity and go to the Neighborhood tab.

    1. From the left navigation, select + Create > Production or Search icon Search > Go to search and browse.

    2. From the list of entities, select one.

    3. Go to the Neighborhood tab.

    4. In the Relationships section, select + Add relationship.

Then, a dialog box opens:

  1. Select one or more entities to create relationships to.

  2. Select a Source to assign this relationship to.

    Caution

    Usual source permissions apply. Users who do not have this Source in their group’s Allowed sources may be able see the related entities but not this relationship.

  3. Select Create relationship.

This creates a relationship between the current entity and the selected target entities.

After creating a relationship here, you can edit it to add Relationship properties.

Edit relationships#

Edit an existing relationship to change it, or add Relationship properties.

Edit new relationship during entity creation

To edit a relationship while creating an entity:

  1. Create an entity.

  2. Create a relationship.

  3. In the Relationships section, locate a relationship you want to edit. On the right of this relationship, select More More > Edit.

  4. Once in the Edit relationship dialog box, set Relationship properties.

  5. Select Save changes to finish editing the relationship.

Edit existing relationship

To edit an existing relationship:

  1. Open an entity that is the source or target of a relationship. You can do this from Search icon Search > Go to search and browse and selecting an entity from the list, or search using the Search query syntax.

  2. Select the Neighborhood tab.

  3. In the Relationships section, locate a relationship you want to edit. On the right of this relationship, select More More > Edit.

  4. Once in the Edit relationship dialog box, set Relationship properties.

  5. Select Save changes to finish editing the relationship.

Relationship properties#

Edit a relationship to set properties for it. You can set these fields in the Edit relationship dialog box:

Field

Description

Direction

For this relationship, set a direction from the current entity to the target entity.

Available options:

  • To related entity

  • From related entity

Relationship

Select a relationship type to assign this relationship.

Select one of the available predefined relationships, or select + Custom relationship to set a custom relationship label and type.

Full list of available relationships is available at Relationship type compatibility tables.

../../_images/relationships--compatibility-icons.png

Compatibility information is displayed when selecting relationship type.#

TLP

Set a TLP color for this relationship.

Known issue

Outgoing feed TLP overrides and filters do not work with relationship objects’ TLP yet.

Start time

Set a start time for this relationship. See Time values.

End time

Set an end time for this relationship. See Time values.

Description

Free text field. Enter a description for this relationship.

Source*

Select one Source for this relationship.

Caution

Usual source permissions apply. Users who do not have this Source in their group’s Allowed sources may be able see the related entities but not this relationship.

Compatibility#

From 3.0, relationship objects have been changed. Exporting entities with relationships from 3.0 and newer is compatible only with certain older versions of EclecticIQ Intelligence Center.

Compatibility with 2.14#

Relationship objects in 3.0 and newer are compatible with 2.14. This means you can export entities with relationships from 3.x in EclecticIQ JSON/EIQ JSON and import them into 2.14.

However, fields in the relationship object that are not supported by 2.14 will be dropped when imported into an EclecticIQ Intelligence Center instance running 2.14.

In 2.14 and earlier, only STIX 1.2-compatible relationships are available. From 3.0 onward, entity relationships have varying compatibility with STIX 2.1 and STIX 1.2 formats (See: Relationship type compatibility tables)

When editing relationships in 3.0 onward, EclecticIQ Intelligence Center UI also displays compatibility information:

../../_images/relationships--compatibility-icons.png

Compatibility information is displayed when selecting relationship type.#

../../_images/relationships--compatibility-admon.png

Resulting compatibility is displayed at the bottom of the Edit relationships dialog box.#

MITRE ATT&CK#

From 3.0, you can no longer assign a MITRE ATT&CK classification to a relationship.