Note

Tip

This entity is analogous to this STIX object:

• STIX 2.1 §4.13 Note SDO

A note is attached to an entity or observable to capture thoughts that you don’t want to commit to a Report or the intelligence itself just yet, but that you do want to make part of further analysis.

Create a Note by:

• In the side navigation bar, selecting + Create > Note.

• Opening an entity or observable and selecting + Note.

• In a list of entities or observables, select any number, and from the top bar select + Add to > Note. Select the dropdown and then select + Create new note.

Then, Customize this note.

Customize

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General

Field	EIQ JSON field	Description
Title*	data.title	Descriptive title for this entity. See Titles and aliases.
Analysis	data.description	Main body of this note. You can add rich text here.

Observables

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	extracts[].kind	See Observable types
Link name*	See Observable link types	See Observable link types
Values(s)*	extracts[].value	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Relationships

Add relationships to this entity by selecting + Add relationship.

See Relationships.

Meta

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Source*	sources[]	Select one source.
Tags	meta.tags[] and meta.taxonomy_paths[]	See tags and taxonomies.
TLP	meta.tlp_color	Set a TLP color for this entity.

Workflow

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.

Save and publish

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

• Publish and new: Publish this entity, and start creating a new entity.

• Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

• Publish and new: Save this entity as a draft, and start creating a new entity.

• Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.