Add edit and remove entities

View workspace entities

To display an overview of all the entities belonging to a workspace :

1. In the left navigation bar, go to Workspaces > VIEW ALL.

2. In the workspace overview, click the workspace whose entities you want to examine to open it.

3. In the top navigation bar click Intelligence > ${workspace_name} > Browse > Entities.

4. In the entity overview you can click to show the available quick filters for the workspace entity overview.

Add entities

To add an entity to an existing workspace, add it to a dataset that is part of the workspace you want to add the entity to.

If the destination workspace had no datasets yet, or if it does not contain a suitable dataset for the entity, you can create a new dataset on the fly and add it to the workspace.

To add an entity to a workspace :

1. Go to one of the following views to see a list of entities. In the left navigation bar, select:

   • Search > GO TO SEARCH AND BROWSE > Entities

   • Create + > VIEW PRODUCTION > Published

   • Discovery

   • Exposure

2. In the entity overview browse to the entity you want to add to a workspace, and then click the corresponding checkbox.

3. Click the menu icon in the row corresponding to the entity you want to add to a workspace.

4. From the drop-down menu select Add to dataset

5. On the pop-up dialog select a destination workspace from the Workspace drop-down menu. To remove a selection, go to the item(s) you want to remove, and click the cross icon .

6. From the Dataset drop-down menu select a target dataset to add the entity to. If the destination workspace had no datasets yet, or if it does not contain a suitable dataset for the entity, select Create new dataset, and then assign it a name under New dataset name.

7. To add the entity to the selected dataset and workspace, click Add to dataset. A pop-up notification message confirms the operation.

Add multiple entities at once

To add multiple entities at once :

1. In the entity overview browse to the entities you want to add, and then click the corresponding checkboxs. On the overview header section a counter helps you keep track of the total amount of selected items.

2. On the overview header section click Add to > Dataset.

3. On the pop-up dialog select a destination workspace and a dataset in the same way as you would when adding a single entity.

Pin entities to the front page

If a workspace is listed, you can pick selected entities and pin them, so that they are included in the public dashboard, and any signed-in Intelligence Center users can view summary information about them.

To pin an entity to the front page and make it visible through the listed workspace public dashboard :

1. In a workspace, go to Browse > Entities.

2. In the entity overview browse to the entity you want to pin to the public dashboard of the workspace, and then click the corresponding checkbox.

3. Click the menu icon in the row corresponding to the entity you want to pin and add to the public dashboard.

4. From the drop-down menu select Pin to front-page.

The entity is added to the public dashboard of the workspace, under Entities. Any signed-in Intelligence Center users can view summary information about it.

Unpin entities from the front page

To remove an entity from the workspace public dashboard, and to make it available only to the workspace collaborators:

1. In an open workspace, go to Browse > Entities.

2. In the entity overview browse to the entity you want to unpin from the public dashboard of the workspace, and then click the corresponding checkbox.

3. Click the menu icon in the row corresponding to the entity you want to unpin and remove from the public dashboard.

4. From the drop-down menu select Unpin from front-page.

The entity is removed from the public dashboard of the workspace. Signed-in Intelligence Center users who are not collaborators of the workspace cannot view it any longer.

Edit entities

1. In the left navigation bar, select Workspaces.

2. Open the workspace that contains the entities you want to edit or select View all to find and open it.

3. From the top bar of tabs, select the Browse tab.

4. To show and to hide the available quick filters in the current view click .

   • Entity type: filter entities by type.

   • Attachment: filter on entities with attachments.

   • External references: filter on entities with external references.

   • Source: filter entities by source.

   • Author: filter entities by their authors.

   • MITRE ATT&CK: filter entities by MITRE ATT&CK classifications.

   • TLP: filter entities by Traffic Light Protocol (TLP).

   • Date: filter entities by date of creation.

   • Reliability: filter entities by reliability. This filter is based on the reliability of the entities source.

   • Dataset: filter entities by dataset.
     Only visible if any of the currently filtered entities are in a dataset.

5. From the Workspace > Browse > Entities page, you can edit entities through:

   • the edit context menu.

   • the entity detail pane.

   • bulk actions (only TLP and confidence).

Edit from the context menu

1. In the list of filtered entities, locate the entity that you want to edit, and click .

2. From the drop-down menu select Edit.

3. Edit the entity to apply your changes as needed.

4. When you have finished editing the entity, select Publish.

EclecticIQ Intelligence Center creates a new version of the entity with the edits you applied.

Edit from the detail pane

1. In the entity table, select the entity that you want to edit.

2. In the entity detail pane, you can edit the entity in one of the following ways:

   1. At the top of the detail pane, click the menu, and select Edit.

   2. When you have finished editing the entity, select Publish.
      EclecticIQ Intelligence Center creates a new version of the entity with the edits you applied.

   OR:

   1. Apply inline edits to any field by clicking .

   2. When you have finished editing the entity fields you want to modify, select Save.

Edit in bulk

1. In the list of entities, apply the necessary filters and select all entities you want to edit by checking the boxes in their rows.

2. Then:

   1. If you want to edit entities’ MITRE classifications, Tags, TLP, or Confidence:

      1. From the top bar select MITRE ATT&CK, Tag, TLP, or Confidence.

      2. In the modal that comes up, select a new value from the dropdown menu and/or deselect values already selected.

      3. Select Save.

   2. If you want to enrich entities:

      1. From the top bar select Enrich.

      2. In the modal that comes up, select the checkboxes of all enrichers you’d like to use.

      3. Select Enrich.

   3. If you want to delete entities:

      1. From the top bar select Delete.

      2. In the modal that comes up, confirm by selecting Delete.

Remove entities

To remove an entity from a workspace, remove it from the workspace dataset it belongs to:

1. In the left navigation bar, go to Workspaces > VIEW ALL.

2. In the workspace overview, click the workspace containing the entity.

3. On the workspace dashboard browse to the Entities section, and then click the entity title to open it.

4. In the entity detail pane, click Actions > Edit.

5. On the entity edit page browse to the Workflow section.

6. Dataset holds the selected datasets the entity belongs to. To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

   The entity is removed from the selected dataset(s).

   If the entity is not included in other datasets that are part of the workspace you want to remove the entity from, the entity is also removed from the workspace.