Location

Tip

This entity is analogous to these STIX objects:

• STIX 2.1 §4.10 Location SDO

Compatibility:

• Not ingested by EclecticIQ Intelligence Center 2.14.

• Not compatible with STIX 1.2

Create an Attack Pattern entity by selecting:

• In the side navigation bar + Create > Attack Pattern.

Or:

• (Requires EclecticIQ Labs: Intelligence creation on the graph)

  In the top navigation bar of a graph, select + and then Attack Pattern to create a draft entity.

• Double-click to open the newly created draft entity to edit it.

Then, Configure this entity.

Configure

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General

Field	EIQ JSON field	Description
Title*	data.title	Descriptive title for this entity. See Titles and aliases.
Analysis	data.description	Long description.
Confidence	data.confidence	See Confidence scale: High Medium low.

Localisation

Field	EIQ JSON field	Description
Latitude	data.latitude	Latitude of this location. Value must be between -90.0 and 90.0, inclusive.
Longitude	data.longitude	Longitude of this location. Value must be between -180.0 and 180.0, inclusive.
Region	data.region	Based on STIX 2.1 §10.21 Region Vocabulary
Country	data.country	Country of location. When exported to STIX 2.1, this is converted to a 2-character ISO3166-1 country code.
Administrative area	data.administrative_area	Administrative area of location. When exported to STIX 2.1, this is converted to s ISO3166-2 code.
City	data.city
Street address	data.street_address
Postal code	data.postal_code
Precision	data.precision	Longitude and latitude set here is accurate up to this number, in meters.

Observables

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	extracts[].kind	See Observable types
Link name*	See Observable link types	See Observable link types
Values(s)*	extracts[].value	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Relationships

Add relationships to this entity by selecting + Add relationship.

See Relationships.

Meta

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Estimated threat start time	meta.estimated_threat_start_time	Estimated start of threat. See Time values.
Estimated threat end time	meta.estimated_threat_end_time	Estimated end of threat. See Time values.
Estimated observed time	meta.estimated_observed_time	Estimated time threat was observed. See Time values.
Half-life	meta.half_life	See Half-life. Select one of these options: Use default value: When selected, half-life for this entity is set to 720 days. Override value: Set a custom value for half-life, in number of days.
Tags	meta.tags[] and meta.taxonomy_paths[]	See tags and taxonomies.
Source*	sources[]	Select one source.
Source reliability	meta.source_reliability	See source reliability. Options: Inherit from source: This entity inherits source reliability from Source. Custom override: Set a source reliability value for just this entity.
TLP	meta.tlp_color	Set a TLP color for this entity.

Information source

Field	EIQ JSON field	Description
Description	data.information_source.description	Description of information source.
Identity	data.information_source.identity	Name of this information source
Roles	data.information_source.roles[]	One or more information source roles. Possible values: Initial Author Content Enhancer/Refiner Aggregator Transformer/Translator
References	data.information_source.references[]	One or more URLs.

Data marking

Descriptive metadata for entity.

Field	EIQ JSON field	Description
Terms of use	data.handling[].marking_structures[]	Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.
Simple	data.handling[].marking_structures[]	Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.
Manually enrich	Run one or more enrichers on this entity on Publish.

Save and publish

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

• Publish and new: Publish this entity, and start creating a new entity.

• Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

• Publish and new: Save this entity as a draft, and start creating a new entity.

• Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.