Entity | Type | Report#

Create Reports to present your findings on different pieces of threat intelligence in a common story with a consistent narrative. Reports allow you to structure and to organize your research, and publish it.

Create#

Create a Report by selecting:

From the left sidebar + Create > Report.

A modal opens asking you to choose:
- Blank report: Start with an empty report.
- Start with Report template: Choose a pre-configured report template.
See Entity | Type | Report | Template for more information about report templates.

Or:

In the top navigation bar of a graph, select + and then Report to create a draft entity.
Double-click to open the newly created draft entity to edit it.

Then, Configure this entity.

Configure#

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General#

Field	EIQ JSON field	Description
Title*	`data.title`	Descriptive title for this entity. See Titles and aliases.
Description	`data.short_description`	The report content. You can add rich text here. See Entities \| Rich text editor.
Confidence	`data.confidence`	See Confidence scale: High Medium low.

Intents#

Add one or more Report intents.

Field	EIQ JSON field	Description
Intents*	`data.types[]`	One or more Report intents. Analogous to ReportIntentVocab-1.0. Possible values: Collective Threat Intelligence Threat Report Indicators Indicators - Phishing Indicators - Watchlist Indicators - Malware Artifacts Indicators - Network Activity Indicators - Endpoint Characteristics Campaign Characterization Threat Actor Characterization Exploit Characterization Attack Pattern Characterization Malware Characterization TTP - Infrastructure TTP - Tools Courses of Action Incident Observations Observations - Email Malware Samples

Field

EIQ JSON field

Description

Intents*

data.types[]

One or more Report intents. Analogous to ReportIntentVocab-1.0.

Possible values:

Collective Threat Intelligence
Threat Report
Indicators
Indicators - Phishing
Indicators - Watchlist
Indicators - Malware Artifacts
Indicators - Network Activity
Indicators - Endpoint Characteristics
Campaign Characterization
Threat Actor Characterization
Exploit Characterization
Attack Pattern Characterization
Malware Characterization
TTP - Infrastructure
TTP - Tools
Courses of Action
Incident
Observations
Observations - Email
Malware Samples

Observables#

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	`extracts[].kind`	See Observable types
Link name*	See Observable link types	See Observable link types
Values(s)*	`extracts[].value`	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Relationships#

Add relationships to this entity by selecting + Add relationship.

See Intelligence metadata | Relationships.

Meta#

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Estimated threat start time	`meta.estimated_threat_start_time`	Estimated start of threat. See Time values.
Estimated threat end time	`meta.estimated_threat_end_time`	Estimated end of threat. See Time values.
Estimated observed time	`meta.estimated_observed_time`	Estimated time threat was observed. See Time values.
Half-life	`meta.half_life`	See Half-life. Select one of these options: Use default value: When selected, half-life for this entity is set to 720 days. Override value: Set a custom value for half-life, in number of days.
Tags	`meta.tags[]` and `meta.taxonomy_paths[]`	See tags and taxonomies.
Source*	`sources[]`	Select one source.
Source reliability	`meta.source_reliability`	See source reliability. Options: Inherit from source: This entity inherits source reliability from Source. Custom override: Set a source reliability value for just this entity.
TLP	`meta.tlp_color`	Set a TLP color for this entity.

Information source#

Field	EIQ JSON field	Description
Description	`data.information_source.description`	Description of information source.
Identity	`data.information_source.identity`	Name of this information source
Roles	`data.information_source.roles[]`	One or more information source roles. Possible values: Initial Author Content Enhancer/Refiner Aggregator Transformer/Translator
References	`data.information_source.references[]`	One or more URLs.

Attachment#

Upload one or more attachments for this report.

Drag and drop files into the box here, or select Upload to browse your local filesystem and select files to upload.

When exported to EIQ JSON, these attachments are base64-encoded and embedded in the attachments[] field of the entity object.
By default, the maximum size for file attachments is 50MB.
To read an attachment after the report is saved, select Go to attachments from the Search entity listing or from the top bar of the entity detail pane. See Entity | Details | Attachments.

Data marking#

Descriptive metadata for entity.

Field	EIQ JSON field	Description
Terms of use	`data.handling[].marking_structures[]`	Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.
Simple	`data.handling[].marking_structures[]`	Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow#

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.
Manually enrich	Run one or more enrichers on this entity on Publish.

Save and publish#

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.

Create content in reports#

You can create content in reports with the rich text editor, and then publish them.

See Entities | Rich text editor for details about editor features and capabilities.

Export and distribute reports#

Reports can be exported and distributed, manually or through outgoing feeds.

Inline images are embedded as attachments in the entity.
When exported as EIQ JSON, images and attachments are base64 encoded and stored in the data.attachments[] field.
In PDF exports, inline images are embedded and displayed.
Attachments and inline images are not supported for STIX 1.2 and STIX 2.1 exports.

STIX 2.1#

Report types#

The STIX 2.1 report_types field is mapped to tags in entities.

When a Report SDO is ingested, all values set in its report_types field are ingested as tags in the resulting Report entity, with the format Report type - <report_type>.

When an EclecticIQ Report entity is exported as STIX 2.1, Report type - <report_type> tags are set as members of the report_types field in the resulting Report SDO, where <report_type> is a valid report-type-ov value.