Intelligence Requirement Categories

An Intelligence Requirement (IR) is a collection of topics or a research question reflecting an organization’s cyber threat–related priorities that guides a security or threat intelligence team’s research and analysis efforts. When creating an IR or updating an existing one in ThreatConnect®, you can choose a category to associate with the IR.

IR categories provide greater control over how to organize your IRs. For example, you can use categories to organize IRs based on different stakeholder groups (e.g., SecOps, HR, Finance) or threat actor types (e.g., Nation State, Hacktivist).

Viewing IR Categories

Follow these steps to view IR categories on your ThreatConnect instance.

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Settingsand select System Settings. The System Settings screen will be displayed with the Settings tab selected.
3. Select the Categories tab. The Categories screen will be displayed (Figure 1).
   

    

When you access the Categories screen while at least one IR category is created, it will display a table with the following columns:

• Category Value: This column displays the IR category’s value.
• Description: This column displays the IR category’s description.
• Usage Count: This column displays the number of IRs on the ThreatConnect instance that use the IR category.

Creating IR Categories

Click the + Add Category Value button on the Categories screen. The Add Category Value window will be displayed (Figure 2).

• Category Value: Enter the value of the IR category.
• Description: Enter a description of the IR category.
• Click the Save button.

The newly created IR category will be displayed in the table on the Categories screen.

Managing IR Categories

The rightmost column in the table on the Categories screen displays the following options for managing IR categories:

• Edit: Click this icon to edit an IR category’s value or description.
• Delete: Click this icon to delete an IR category.
  Important

  If an IR category is being used by at least one IR object, you cannot delete it. In this scenario, the Deleteicon will not be displayed in the rightmost column for the IR category.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20159-04 v.01.A