Threat Actor#

Tip

This entity is analogous to these STIX objects:

You can also use the Intrusion Set and Identity entities to represent malicious actors.

A threat actor is an adversary who is motivated to damage an individual, a group, an entity or an organization. Threat actors can be individuals, groups, or organizations; they can be nation-sponsored or nation-state actors; they can be external to the targeted victims, or they can be insider threats. The motivation that drives them ranges from economic, political, ideological, to revenge and bragging. The benefits they gain from attacking a targeted victim vary from financial, to reputation damage, to intellectual property theft, and so on.

You can associate threat actors to TTPs and campaigns to understand how they plan and organize their attacks to the targeted victims. Indicators can help you track them, and relate them to observables and sightings. For example, an email address, an IP address, or a domain name associated with a real person’s identity.

Create a threat actor by selecting:

In the side navigation bar + Create > Threat actor.

Or:

(Requires EclecticIQ Labs: Intelligence creation on the graph)

In the top navigation bar of a graph, select + and then Threat actor to create a draft entity.
Double-click to open the newly created draft entity to edit it.

Then, Configure this entity.

Configure#

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General#

Field	EIQ JSON field	Description
Name*	`data.title`	Descriptive title for this entity. See Titles and aliases.
Analysis	`data.description`	Free text description of entity.
Types*	`data.types[]`	One or more threat actor types. Select a predefined type, or add a custom type by typing in the field and pressing `ENTER`. See Threat actor types
Aliases	`data.aliases[]`	One or more known names to identify this threat actor by. When this entity is published, also creates one `name` observable for each alias here.
Intended effects	`data.intended_effects`	See Intended effects. For STIX 2.1, maps to `goals` property of Threat Actor SDO.
Confidence*	`data.confidence`	See Confidence scale: High Medium low.

Observables#

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field	EIQ JSON field	Description
Type*	`extracts[].kind`	See Observable types
Link name*	See Observable link types	See Observable link types
Values(s)*	`extracts[].value`	Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both.
Maliciousness*	See Observable maliciousness	See Observable maliciousness

Characteristics#

Characteristics are properties on an entity that provide context for the intelligence indicated by this object.

The following are characteristics available for threat actors:

Field	EIQ JSON field	Description
Motivations	`data.motivations[]`	Based on STIX 2.1 §10.2 Attack Motivation Vocabulary. If entity is imported from an earlier version of EclecticIQ Intelligence Center, can contain values from MotivationVocab-1.1
Personal motivations	`data.personal_motivations[]`	Based on STIX 2.1 §10.2 Attack Motivation Vocabulary.
Sophistication	`data.sophistication`	Based on STIX 2.1 §10.25 Threat Actor Sophistication Vocabulary. If this entity is imported from an earlier version of EclecticIQ Intelligence Center, can contain values from ThreatActorSophisticationVocab-1.0.
Resource level	`data.resource_level`	Based on STIX 2.1 §10.3 Attack Resource Level Vocabulary.
Planning and operational support	`data.planning_and_operational_support[]`	Based on PlanningAndOperationalSupportVocab-1.0.1.
Roles	`data.roles[]`	Based on STIX 2.1 §10.24 Threat Actor Role Vocabulary.

Relationships#

Add relationships to this entity by selecting + Add relationship.

See Relationships.

Meta#

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field	EIQ JSON field	Description
Estimated threat start time	`meta.estimated_threat_start_time`	Estimated start of threat. See Time values.
Estimated threat end time	`meta.estimated_threat_end_time`	Estimated end of threat. See Time values.
Estimated observed time	`meta.estimated_observed_time`	Estimated time threat was observed. See Time values.
Half-life	`meta.half_life`	See Half-life. Select one of these options: Use default value: When selected, half-life for this entity is set to 720 days. Override value: Set a custom value for half-life, in number of days.
Tags	`meta.tags[]` and `meta.taxonomy_paths[]`	See tags and taxonomies.
Source*	`sources[]`	Select one source.
Source reliability	`meta.source_reliability`	See source reliability. Options: Inherit from source: This entity inherits source reliability from Source. Custom override: Set a source reliability value for just this entity.

Information source#

Field	EIQ JSON field	Description
Description	`data.information_source.description`	Description of information source.
Identity	`data.information_source.identity`	Name of this information source
Roles	`data.information_source.roles[]`	One or more information source roles. Possible values: Initial Author Content Enhancer/Refiner Aggregator Transformer/Translator
References	`data.information_source.references[]`	One or more URLs.

Data marking#

Descriptive metadata for entity.

Field	EIQ JSON field	Description
TLP	`meta.tlp_color`	Set a TLP color for this entity.
Terms of use	`data.handling[].marking_structures[]`	Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.
Simple	`data.handling[].marking_structures[]`	Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow#

Use options here to apply workflow options to this entity.

Field	Description
Add to dataset	Select this option to add this entity to one or more datasets on Publish.
Manually enrich	Run one or more enrichers on this entity on Publish.

Save and publish#

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More and then one of these options:

Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More and then one of these options:

Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.

Appendix#

Threat actor types#

Characterizes this threat actor.

The threat actor entity allows you to set a type by:

Selecting from a set of predefined values.

These predefined values are derived from the STIX 1.2 ThreatActorTypeVocab-1.0.
Or, entering a custom value.

Tip

For compliance with STIX 2.1 recommendations, enter custom values that correspond to the STIX 2.1 §10.23 Threat Actor Type Vocabulary.

When this entity is exported to STIX 1.2 or STIX 2.1 formats, the entity’s type values are mapped to the corresponding Threat Actor object’s type field:

STIX 2.1
STIX 1.2.

Identity property#

The identity property is no longer part of the Threat Actor entity. Use the Identity entity instead.