Adding new nodes to Investigation Canvas

Use this section to create and add new entities, including observables or objects, directly from the investigation canvas.

Before you begin

This feature enables quick enrichment of the canvas without having to navigate away from the current view.

Role required: sn_sec_tisc.analyst

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Select the Threat Analyst Workbench icon.
3. Go to Case Management > All Cases.
4. Open any case record.
   Note:

   When creating a case, you’re required to either create a canvas or link an existing one. After linking, the canvas actions including the option to add new nodes will be automatically available in the user interface.
5. Select Investigation Canvas > New Node.
   • You can also view the New Node functionality from the drop-down list of the emptyInvestigation Canvas section of the Case.
   • Another option to view the New Node functionality is to view from the investigation canvas page directly.
6. To create a node, select the appropriate Entity Category and Entity Type.

   Field	Description
   Entity Category	Select the entity category such as Observable, or Object.
   Entity Type	Select the entity type from the available options based on the select category. Note: When an entity type is selected, the corresponding object form is automatically displayed, showing the key fields such as Name and Description along with any required fields that are needed to identify the parent entity. If you attempt to create a duplicate entity, which means if you select an entity, which is existing in the application and try to create one with the same value then an error message will appear indicating that the entity already exists in the Threat Intelligence Library with the same value and type.

7. Fill the necessary object details such as name, description.
8. Select Add to add the new node.
   This process automatically adds the node to the investigation canvas.

   The newly added nodes are visually differentiated with a dot on the node them from nodes that are imported through the library or case artifacts.

   Important:

   Newly added nodes are temporary and aren’t saved to the threat intelligence library or canvas. If you refresh the canvas before saving, these nodes will be lost. Make sure to save the canvas after adding any new nodes to retain your changes.
9. Right click on the new node and select Add Relationship option to create relationships between the nodes.
   Note:

   • When creating new relationships, the edges are appeared as dotted lines, indicating they are temporary nodes and aren’t saved in the Threat Intelligence Library.
   • Newly added edges are temporary and aren’t saved to the threat intelligence library or canvas. If you refresh the canvas before saving, these edges will be lost. Make sure to save the canvas after adding any new edges to retain your changes.

   

10. Right click and select Show Details to view the details related to the selected entity.
    Note:

    To add data, you can either click the hyperlink within the details pane or select Open Record option and add the required node related data.
11. Select Add Data to Library option to save all the nodes and edges that were temporarily added during your investigation.
    By performing this action, the temporary records are converted to permanent aggregated records within the Threat Intelligence Library.