Define Data Sources

Define a data source to represent the various subjects or topics of information.

시작하기 전에

Role required: sn_sec_tisc.analyst

프로시저

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Click on Threat Intel Library icon on the workspace.
3. Go to Data Sources object.
4. Click New.
   주:

   Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record.
5. On the form, fill in the fields.

   표 1. Vulnerabilities Details view

   Field	Description
   ID	Unique ID to identify the data source.
   Name	A name used to identify the data source.
   Description	A description that provides more details and context about the data source, potentially including its purpose and its key characteristics.
   Collection Layers	Indicates the description of where the data source may be physically collected such as Host, Network, Cloud Control Plane, and so on.
   Platforms	Indicates the system an adversary is operating within could be an operating system or application.
   Contributors	Indicates the contributors for this data source.
   TLP	TLP is used to ensure that sensitive information is shared with the appropriate audience. It employs four colors (White, Green, Amber, and Red) to indicate different degrees of sensitivity.
   Source	Specifies the threat source from which this object record is created.
   Revoked	Indicates that the revoked objects are no longer considered valid by the object creator.

   표 2. Insights

   Field	Description
   Notes	Add any additional notes for this data source.

   표 3. Additional Information

   Field	Description
   Additional Context	Add any additional context for this data source.
   Spec Version	The version of the STIX specification used to represent this object. The value of this property must be 2.1 for STIX Objects defined according to this specification.
   Lang	This property identifies the language of the text content in this object.
   Created Time In Source	Specifies the time the object is created in the source.
   Extensions	Indicates the extensions of attack pattern.
   Modified Time in Source	Specifies the time the object is modified in the source.
   Processing Status	Represents the processing status of this object, course of action.
   Created	Specifies the date and time when the object is created in the source.
   Updated	Specifies the date and time when the object was updated in the source.
   Created By Ref	This property specifies that the identity object that describes the entity had created this object.

6. Click Save.
   After you save, a prompt message is displayed indicating that A new observable record is created. Click Continue to edit the record and create new relationships.
7. Click Continue.
   중요사항:

   After you create a new observable record, Prevent System Updates check box is displayed.

   Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created.

   표 4. Tags&Taxonomies

   Field	Description
   Tags
   Select Tags	Select the tags that are associated with the data source.
   Add Tags	Add new tags.
   Taxonomies
   Select Taxonomy	Select a Taxonomy that is associated with this data source.
   Add Taxonomy Values	Add Taxonomy values that are associated with this data source.

다음에 수행할 작업

Click any of the following related lists to view additional information about objects associated with the data source.

표 5. Related Records

Field	Description
External References	Lists the external references which refer to non-STIX information. This property is used to provide one or more external object identifiers.

주:

1. You can link and unlink the related records associated with this object. For more information, see Link Threat Intel Related Records.
2. The various SDOs within the TI library also contains the potential relationships. To establish a relationships between any two objects, you use the Potential Relationships link from the Threat Intel Library to confirm the relationships between the objects. For more information, see Confirm object-object potential relationships.
3. Also, use the Related Records section from the objects form view to confirm the relationships between two Objects using the Potential Relationships section available on the form view. For more information on see, Confirm Potential Relationships from Related Records.
4. You can add objects to cases. For more information, see Add to Case.