Intelligence Requirement Categories

Overview

An Intelligence Requirement (IR) is a collection of topics or a research question reflecting an organization’s cyber threat–related priorities that guides a security or threat intelligence team’s research and analysis efforts. When creating an IR or updating an existing one in ThreatConnect®, you can choose a category to associate with the IR.

IR categories provide greater control over how to organize your IRs. For example, you can use categories to organize IRs based on different stakeholder groups (e.g., SecOps, HR, Finance) or threat actor types (e.g., Nation State, Hacktivist).

System Administrators can view, create, and manage IR categories on the System Settings screen.

Before You Start

User Roles

• To view, create, edit, and delete IR categories, your user account must have a System role of Administrator.

Viewing IR Categories

Follow these steps to view IR categories on your ThreatConnect instance.

1. Hover over Settingson the top navigation bar and select System Settings.
2. Select the Categories tab (Figure 1).
   

    

If at least one IR category is created, the Categories screen will display a table with the following columns:

• Category Value: The IR category’s value.
• Description: The IR category’s description.
• Usage Count: The number of IRs on your ThreatConnect instance that use the IR category.

Creating IR Categories

Follow these steps to create IR categories on your ThreatConnect instance:

1. Hover over Settingson the top navigation bar and select System Settings.
2.  Select the Categories tab.
3. Click + Add Category Value.
4. Fill out the fields on the Add Category Value window (Figure 2) as follows.

   

    

   • Category Value: Enter the value of the IR category.
   • Description: (Optional) Enter a description of the IR category.
5. Click Save on the Add Category Value window.

Managing IR Categories

Follow these steps to manage IR categories on your ThreatConnect instance:

1. Hover over Settingson the top navigation bar and select System Settings.
2. Select the Categories tab.
3. Select one of the following options in the rightmost column for an IR category:
   • Click Editto edit the IR category’s value or description.
   • Click Deleteto delete the IR category.
     Important

     If an IR category is being used by at least one IR object, the Deleteoption will not be available.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20159-04 v.02.A