Define tools
Define tools as legitimate software that is used to perform attacks.
Before you begin
Role required: sn_ti.admin
Procedure
Navigate to All > Threat Intelligence > IoC Repository > Tools.
Click New.
Complete the fields in the form as appropriate.
Field Description Name Enter a descriptive name to identify the tool. Source Specifies the threat source from which this record is created. Description A description that provides more details and context about the tool, potentially including its purpose and its key characteristics. Aliases Alternative names to identify this tool. Source ID Unique identifier for this object in the threat source. Created Time in Source Specifies the time the object is created in the source. Modified Time in Source Specifies the time the object is modified in the source. Click Submit.
What to do next
Click any of the following related lists to view additional information about objects associated with the tool object.
| Related Links and Related Lists | Description |
|---|---|
| External References | Lists external references which refer to non-STIX information. This property is used to provide one or more external object identifiers. |
| Associated Kill Chain Phases | Lists kill chain phases associated with this object. |
| Associated Types | Lists indicator types associated with this object. |
| Attack Patterns | Lists the attack patterns that help categorize attacks that are associated with this object. |
| Campaigns | Lists campaigns associated with this object. |
| Course of Actions | Lists the associated course of actions with this object that are technical or automated responses \(applying patches, reconfiguring firewalls\) to prevent an attack. |
| Identities | List of identities associated with this object. |
| Indicators | Lists related Indicators of Compromise \(IoC\) that have been identified by the threat source associated with this object. |
| Infrastructure | Lists systems, software services, and any associated physical or virtual resources that are associated with this object. |
| Intrusion Set | Lists a set of adversarial behaviors and resources with common properties associated with this object. |
| Locations | Lists locations that provide geographic context to this object. |
| Malware | Lists malicious code associated with this object. |
| Threat Actors | Lists individuals, groups, or organizations who act with malicious intent associated with this object. |
| Vulnerabilities | Lists a weakness or defect in a software or hardware that attackers exploit which is associated with this object. |
| Show Relationships | Opens the STIX Visualizer where you can view the relationship of the STIX object.Show Relationships appears only when the object has an associated object. |
Parent Topic:Tools