Use | Process | Property propagation

(Requires EclecticIQ Labs: Property propagation)

Set property propagation rules to have EclecticIQ Intelligence Center copy the necessary details from specified Entities over to all Entities that match the rule.

You can configure a Property propagation rule to:

• propagate from new matching Entities as they are ingested or created.

• periodically propagate to and from existing Entities.

• do both; that is, propagate to and from new Entities as well as periodically propagate to existing Entities.

Create

1. From the left sidebar, select Data configuration > Property propagation.

2. In the top right corner, select + Create Rule.

3. Enter a Name.

4. (Optional) Enter a Description.

5. Select either:

   • the Run on new data checkbox to have newly ingested or created Entities propagate their properties to others,

   • the Reprocess property propagation rule on existing data checkbox to periodically propagate to and from existing Entities,

   • or both checkboxes.

6. If you selected the Reprocess on existing data checkbox, the rule:

   • will run according to the Execution schedule you set, and

   • will propagate from Entities for which the Timestamp of the type you select falls within the scope you select in the Consider data from drop-down menu.

7. Under Entities providing properties, set filters defining the Entities you would like to propagate details from and exclude all others. Not all criteria are required, but specificity is advised to prevent unnecessary or erroneous propagation.
   To do this, select + Add criteria, and:

   • select Entity types, then select the drop-down menu that appears and add the relevant Entity types.

   • select Content criteria, then add filters using search query attributes and logical operators.

   • select Sources, then select the drop-down menu that appears and add the relevant sources.

   • select TLPs, then select the drop-down menu that appears and add the relevant TLPs.

8. Under Copy properties to related Entities, set filters defining the properties you would like to propagate to other Entities. To do this, select + Add property, and:

   • select Tags, then select either the Copy all tags or Copy only selected tags checkbox.
     If you select the latter, select whether to Include or Exclude matching tags from propagation with the checkboxes that appeared. Then, select the drop-down menu and select the relevant tags or add a query matching them (using the * wildcard character if needed).

   • select Mitre ATT&CK classifications.

   • select Half-life.

   • select TLPs.

   • select Intelligence requirements.

9. Under Related Entities receiving properties, define how properties should propagate based on Entity relationships. Multiple options can be selected simultaneously. Choose from:

   • Direct: Properties propagate from the origin Entity to any directly related target Entities that match your configured filters. No intermediary relationships are considered.

   • Related through Entities: Properties propagate from the origin Entity to target Entities connected through one or more intermediary Entities. The intermediary Entities themselves do not receive the propagated properties unless they also match the rule as directly related targets. Select Any Entity type to propagate through all Entity types. Select Only related through specific Entity types, then use the drop-down menu to select only the Entity types that should serve as connection paths.

   • Related through Observables: Properties propagate from the origin Entity to target Entities when they share one or more common Observables. Select at least one Observable type from the drop-down menu to use this relationship path.

The Property progation rule will:

• propagate the properties you selected,

• from Entities matching the criteria you set,

• to any Entity that matches filters you set,

• through the relationship paths you configured.

Manage

1. Go to Data configuration > Property propagation rules.

2. In the row of the rule you’d like to edit, open the menu and select Edit.

3. Change the characteristics of the Property propagation rule that you’d like to change.

4. Select Save when you’re done.

Manually run the rule

1. Go to Data configuration > Property propagation rules.

2. In the row of the rule you’d like to edit, open the menu and select Run now.