Add entities to a graph

There are several ways to add an entity to a graph:

• In a graph: create a draft entity in the graph.

• In a graph: add a published entity to the graph.

• In a published entity: using Add to graph from the actions menu.

• In a published entity: from the Neighborhood tab.

Each method is explained below.

Create a draft entity while in a graph

Note

EclecticIQ Labs: Go to Settings > System settings and select EclecticIQ Labs > Enable intelligence creation on the graph.

When you are working on a graph, you can create draft entities on the fly without leaving the graph canvas. You can recognize a draft entity by the dashed circle around it.

Tip

Use this method to add draft entities to saved or unsaved graphs.

To create a draft entity in a graph:

1. Click + in the top navigation bar.

2. Select the entity type you want.

3. Give the entity a name.

The entity is created as a draft entity.

• To edit the entity’s details, double-click its icon.

• To publish the entity, click |icon-publish| in the top navigation bar.

Add a published entity while in a graph

When you are working on a graph, you can add published entities on the fly without leaving the graph canvas.

Tip

Use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to a graph:

1. Click (add from Search), (add from Discovery), or (add from Workspaces).

2. (Optional) Filter visible entities by selecting .

   Select options from the following dropdown menus to filter visible entities:

   • Entity type: select one or more checkboxes to load to the graph only the specified entity types.

   • Source: select one or more checkboxes to load to the graph only entities belonging to the specified data sources.

   • TLP: select one or more checkboxes to load to the graph only entities with specific TLP color-codes.

   • Date: select a time interval to load to the graph only entities ingested between the specified start and end dates.

   • Dataset: select one or more checkboxes to load to the graph only entities belonging to the specified datasets.

     The option to filter by dataset is only available when the current view or the results include entities belonging to at least one dataset

3. After selecting the entities to add to the graph, in the bottom-right corner click Add to graph.

Add a published entity from its actions menu

When you are working in a published entity’s detail pane, you can add add it to a graph using its actions menu.

Tip

Use this method to add an entity to the currently open graph.

You can use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to a graph using the entity’s actions () menu:

1. Locate the entity you want in one of the following ways:

   1. In the top navigation bar click Search > GO TO SEARCH AND BROWSE, Discovery or Exposure.

   2. In the top navigation bar click Data configuration > Incoming feeds > ${incoming_feed_name} > Entities.

2. Click the entity.

3. In the top-right corner click .

4. From the drop-down menu select Add to graph.

To see if the entity has been loaded to the currently open graph, hover the mouse pointer over in the side navigation bar to display a thumbnail view of the current graph canvas.

Add a published entity from its Neighborhood tab

When you are working in a published entity’s detail pane, you can add add it to a graph using its Neighborhood tab.

Tip

Use this method to add published entities to both saved and unsaved graphs.

You cannot add draft entities to a graph using this method.

To add a draft entity to a graph, use the Create a draft entity while in a graph method.

To add a published entity to either a graph using the entity’s Neighborhood tab:

1. Locate the entity you want in one of the following ways:

   1. In the top navigation bar click Search > GO TO SEARCH AND BROWSE, Discovery or Exposure.

   2. In the top navigation bar click Data configuration > Incoming feeds > ${incoming_feed_name} > Entities.

2. Click the entity.

3. Click the Neighborhood tab.

4. In the Neighborhood tab, click CREATE IN NEW GRAPH or LOAD IN OPEN GRAPH.

5. The graph canvas opens to show the entire content of the selected graph.

To see if the entity has been loaded to the currently open graph, hover the mouse pointer over in the side navigation bar to display a thumbnail view of the current graph canvas.