Define identities

  • Release version: Yokohama
  • Updated January 30, 2025
  • 1 minute to read

    • Define identities who represent actual individuals, organizations, or groups.

    Before you begin

    Role required: sn_ti.admin

    Procedure

    1. Navigate to All > Threat Intelligence > IoC Repository > Identities.
    2. Click New.
    3. Complete the fields in the form as appropriate.
      FieldDescription
      Name Enter a descriptive name for this identity.

      When referring to a specific entity (an individual or organization), this property must contain the canonical name of the specific entity.
      Identity Class The type of entity that this identity describes.

      For example, individual or organization.
      Source Specifies the threat source from which this record is created.
      Description A description that provides more details and context about the identity, potentially including its purpose and its key characteristics.
      Source ID Unique identifier for this object in the threat source.
      Created Time in Source Specifies the time the object is created in the source.
      Modified Time in Source Specifies the time the object is modified in the source.
    4. Click Submit.

    What to do next

    Click any of the following related lists to view additional information about objects associated the identity.
    Related Links and Related Lists Description
    Show Relationships Opens the STIX Visualizer where you can view the relationship of the STIX object.

    Show Relationships appears only when the object has an associated object.
    External References Lists external references which refer to non-STIX information. This property is used to provide one or more external object identifiers.
    Attack Patterns Lists the attack patterns that help categorize attacks that are associated with this object.
    Campaigns Lists campaigns associated with this object.
    Intrusion Set Lists a set of adversarial behaviors and resources with common properties associated with this object.
    Locations Lists locations that provide geographic context to this object.
    Malware Lists malicious code associated with this object.
    Threat Actors Lists individuals, groups, or organizations who act with malicious intent associated with this object.
    Tools Lists legitimate software that is used by threat actors to perform attacks associated with this object.