Add a related attack mode/method to an IoC

In addition to importing related attack modes/methods as STIX data, you can add related attack modes/methods to an IoC manually.

Before you begin

Role required: sn_ti.write

Procedure

1. Navigate to All > Threat Intelligence > IoC Repository > Indicators.

2. Click the indicator to which you want to add a related attack mode/method.

3. Click the Related Attack mode/method related list.

4. Click Edit.

5. As needed, use the filters to locate the attack mode/method you want to relate with the IoC.

6. Using the slushbucket, add the attack mode/method to the Related Attack mode/method list.

7. Click Save.

Parent Topic:Indicators of compromise

Related topics

View an IoC

Add a related observable to an IoC

Identify associated indicator types

Identify indicator sources

Add associated tasks to an IoC