User and higher
Tagging is a powerful and easy way to add metadata to threat intelligence. Tags in ThreatConnect® create associations between the data to which they are applied, as well as a path from one intelligence item to another.
- From the top navigation bar (Figure 1), place the cursor over Browse and then over the Indicators or Groups option. Click on an object (Host Indicator in this example) to display a results table (Figure 2).
- Click on one of the entries, and the Details drawer for that entry will appear (Figure 3).
- Click the Details icon at the top right corner of the drawer, and the Overview screen will appear. Alternatively, hover over the object's entry in the table in Figure 2 and click on the Details icon that appears on the right side of its Summary cell to go straight to the Overview tab of the Details screen. Scroll down until the Tags card is visible (Figure 4).
- Apply a Tag directly to an object by entering the name of the Tag into the textbox and then clicking the Plus button (Figure 5). The textbox has an auto-complete feature for Tags stored in the database. Tags that have already been applied to the object are shown on the right-hand side of the card. To remove a Tag, click the X on the right of the Tag.
- Click on the Common Tags text to display a list of frequently used Tags (Figure 6). Selecting one will apply it to the Tag list for the object, and it will be displayed to the right of the textbox.