Upload Files | Upload with custom data mapping#

With custom data mapping, you can upload CSV files to have the structured data in them extracted according to a template you already defined or a template you define during the import (see below).

Note

Files uploaded in Custom data mapping have a maximum size of 10MB.

From the left sidebar, select + Create > Upload.
Under Custom data mapping in the pop-up, select Upload >.
Select the drop window in the modal to rowse your network for files/archives, or drag and drop files into the modal window.
To delete a file from the list of uploaded files, select the X to the right of its name.
In the Source field, select a group. All entities and observables ingested from the uploaded files will have this group assigned as their source.

(Optional) Select the following options if they apply to your upload(s):

Option

Description

Override source reliability:

Set a source reliability for all incoming objects.

Extract observables from unstructured text:

Select this option to parse the text in uploaded files and create observables that match well-known text patterns.

Password protected archive:

Allows you to provide the password when uploading password protected archives.

Add information source details:

Add the below listed information to the source for uploaded files.

Field	Description
Description	Provide a source description.
Identity	Name of source.
Roles	Select at least one of the following roles: Initial Author Content Enhancer/Refiner Aggregator Transformer/Translater
References	Set one or more URLs.

Override TLP:

Override TLP values for all incoming objects.

In the Data mapping, either:
1. Select a saved Data mapping template.
  See Upload Files | Data mapping templates to learn more.
2. Then select Start import from the bottom right to start importing this CSV file.
Or:
1. Select Custom mapping to create a custom CSV mapping in the next step.
2. Select Continue from the bottom right to start creating a custom mapping for this file import.
3. Choose a Delimiter by selecting the checkbox of the character that delimits values in the files you want to upload, or select Other and enter the delimiting character in the field that appears.
4. (Optional) If the files you want to upload use one, enter the Quote character that encloses fields which include special characters to escape.
5. (Optional) If the files you want to upload have lines without data that begin with #, toggle Non-date lines on.
6. (Optional) If the files you want to upload have headers as the entries in the first line, toggle Headers on.
7. Select Continue.
8. For each column in the files you want to upload, select Add mapping and, from the drop-down menu under Matching fields in EclecticIQ, select the EclecticIQ Intelligence Center (EIQ IC) field(s) the data in that column should be mapped to. If you want to add more fields later, select the + Add field link for that column.
  
  Sub-dividing column fields
  
  If you selected multiple fields from the Matching fields in EclecticIQ drop-down menu, toggle Split values in column to ON if the column contains multiple values separated by a delimiter. From the drop-down list that appears if the switch is on, select the delimiting character used in the fields of that column.
  Not selecting a delimiting character when Split values in column is on will result in the value of the fields of that column being copied to all the fields you selected under Matching fields in EclecticIQ.
9. Select Continue.
10. On the Configure screen, you will see drop-down menus for all the EIQ IC field you haven’t mapped a column to. You can select default values for these fields or choose not to leave these field empty by selecting None.
  This screen also allows you to review the fields you have mapped columns to, so you can go back and correct them if you spot any mistakes.
11. Select Continue.

Once the import concludes you can see the results in the modal or, if you had closed the modal already, you can open your notifications and select the one about your import to see the result.