Indicator enrichment detail in layout

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Indicator enrichment detail in layout

L2 Linker

Hi,

 

In one of our playbook there are 2 enrichment type of integrations deployed for ip enrichment (virustotal and abusedb) all works well as expected and they feed indicator itself but shows only verdict in indicator layout although these enrichments return much more detailed data. I need help about visualize this detailed post-indicator-enrichment data into layout.

 

These are the data i mentioned and i dont want my analyst to waste time into browsing to this pages.

 

MKececioglu_0-1661949108501.png

 

MKececioglu_1-1661949119395.png

 

Best regards.

 

  

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @MKececioglu,

 

There are 2 places you can see indicator information. 

 

1. As a part of the indicators table added to a layout. You can customise the displayed columns by click on the gear cog while editing the layout.

Screen Shot 2022-09-01 at 11.51.31 am.png

 

2. You can also click on the indicator's value field like above or in the warroom, this will display the indicator quick view panel. The contents of this panel can be customised inside the indicator layout.

Screen Shot 2022-09-01 at 11.53.54 am.png

 

The information you require must exist inside a defined indicator field. I would suggest you:-

1. Identify what information your analyst require

2. Identify where the information is stored inside the indicator

3. If stored inside a field, customise the layout

4. If not, configure a job or mapper to populate those fields for future indicators. Then customise the layout.

 

View solution in original post

1 REPLY 1

L4 Transporter

Hi @MKececioglu,

 

There are 2 places you can see indicator information. 

 

1. As a part of the indicators table added to a layout. You can customise the displayed columns by click on the gear cog while editing the layout.

Screen Shot 2022-09-01 at 11.51.31 am.png

 

2. You can also click on the indicator's value field like above or in the warroom, this will display the indicator quick view panel. The contents of this panel can be customised inside the indicator layout.

Screen Shot 2022-09-01 at 11.53.54 am.png

 

The information you require must exist inside a defined indicator field. I would suggest you:-

1. Identify what information your analyst require

2. Identify where the information is stored inside the indicator

3. If stored inside a field, customise the layout

4. If not, configure a job or mapper to populate those fields for future indicators. Then customise the layout.

 

  • 1 accepted solution
  • 1267 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!