Pivoting on Data

Last Updated: Aug 30, 2019 04:37PM EDT
User
None

Overview

Pivoting is an analytic transition in which a user in ThreatConnect® moves from one entity—Indicators and Groups in the ThreatConnect Data Model, as well as Tags and Attributes—to an associated entity in accordance with the methodology defined by the Diamond Model. Through the process of pivoting, users can, in a contiguous manner, explore relationships and find correlations between entities.

Steps

  1. On the top navigation bar (Figure 1), place the cursor over Browse and then over the Indicators or Groups option (Indicators in this example). Click on an object (Host in this example) to display a results table (Figure 2).
  2. Click on one of the entries, and the Details drawer for that entry will be displayed (Figure 3).
  3. Click the vertical ellipsis icon at the top right of the drawer. A dropdown menu with the Pivot option will be displayed (Figure 4).
  4. Click the Pivot option, and the Browse screen will display all Groups associated with the Indicator (Figure 5), with the Indicator shown in a gray rectangle above the results table. If the initial object is a Group, then choosing the Pivot option will cause the Browse screen to display all associated Indicators.
  5. The same pivoting operation may be performed by navigating to the Overview tab of the Details screen for the object—either by clicking the Details icon at the top right corner of the the Details drawer (Figure 3) or by hovering over the object's entry in the table in Figure 2 and then clicking the Details icon that appears on the right side of its Summary cell)—and then clicking the PIVOT button on the top left of the screen (Figure 6).

Pivoting from a Tag

  1. On the top navigation bar (Figure 1), place the cursor over Browse and then click on the Tags option to display a results table (Figure 7).
  2. Click on one of the entries, and the Details drawer for that entry will be displayed (Figure 8).
  3. Click the vertical ellipsis icon at the top right of the drawer. A dropdown menu with the Pivot option will be displayed (Figure 9).
  4. Click on the Pivot option, and the dropdown menu will change to provide a choice between pivoting on Indicators or Groups (Figure 10).
  5. Select one of the options (Indicators in this example), and the Browse screen will display a results table for all of the selected objects that have the chosen Tag (Figure 11).

Pivoting on an Attribute

  1. On the top navigation bar (Figure 1), place the cursor over Browse and then over the Indicators or Groups option (Groups in this example). Click on an object (Incident in this example) to display a results table (Figure 12).
  2. Click on one of the entries, and the Details drawer for that entry will be displayed (Figure 13).
  3. Click the Details icon at the top right corner of the drawer, and the Overview tab of the Details screen will be displayed (Figure 14). Alternatively, hover over the object’s entry in the table in Figure 12 and click on the Details icon that appears on the right side of its Summary cell to go straight to the Overview tab of the Details screen.
  4. Scroll down to view the Attributes card (Figure 15).
  5. Click the magnifying glass icon next to an Attribute, and the Browse screen will be displayed, showing all objects that have this Attribute, with the Attribute shown in a gray rectangle above the results table (Figure 16). Only Attributes that have a maximum length of 500 characters or under will have a magnifying glass displayed.

20034-06 EN Rev. A

Contact Us

  • ThreatConnect, Inc.
    3865 Wilson Blvd.
    Suite 550
    Arlington, VA 22203

    Toll Free:   1.800.965.2708
    Local: +1.703.229.4240
    Fax +1.703.229.4489

    Email Us



https://cdn.desk.com/
false
desk
Loading
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
about
false
Invalid characters found
/customer/en/portal/articles/autocomplete