Pivoting on Data
- 24 Jan 2024
- 3 Minutes to read
-
Print
-
DarkLight
Pivoting on Data
- Updated on 24 Jan 2024
- 3 Minutes to read
-
Print
-
DarkLight
Article summary
Did you find this summary helpful?
Thank you for your feedback
Overview
Pivoting is an analytic transition in which you move from one entity—Indicators and Groups in the ThreatConnect® Data Model, as well as Tags and Attributes—to an associated entity as defined by the Diamond Model. Through pivoting, you can explore relationships and find correlations between entities in a contiguous manner.
Before You Start
Minimum Role(s) | Organization role of Read Only User |
---|---|
Prerequisites | An Indicator, Group, Tag, or Attribute created in one of your ThreatConnect owners |
Pivoting from an Indicator or Group
There are three areas in ThreatConnect where you can pivot from an Indicator or Group: the Details drawer, the new Details screen, and the legacy Details screen.
Important
The new Details screen is not currently available for Email, Signature, and Task Groups. As such, you can pivot from these Group types on the Details drawer and legacy Details screen only.
Details Drawer
- On the top navigation bar, hover over Browse and select Indicators, Groups, or a specific Indicator or Group type. The Browse screen will display a results table containing objects of the selected type.
- Click on an entry to display its Details drawer.
- Click the vertical ellipsisat the upper-right corner of the drawer and select Pivot. The Browse screen will be displayed with the following elements on the screen (Figure 1):
- A results table containing all Groups (if you selected Pivot on an Indicator’s Details drawer) or Indicators (if you selected Pivot on a Group’s Details drawer) associated to the object from which you pivoted.
- A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.
New Details Screen
- Navigate to the Details screen for an Indicator or Group.
- Click the Optionsbutton at the top right of the screen and select Pivot. The Browse screen will be displayed with the following elements on the screen:
- A results table containing all Groups (if you selected Pivot on an Indicator’s Details screen) or Indicators (if you selected Pivot on a Group’s Details screen) associated to the object from which you pivoted.
- A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.
Legacy Details Screen
- Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
- Click the Pivot button at the top left of the screen. The Browse screen will be displayed with the following elements on the screen:
- A results table containing all Groups (if you clicked the Pivot button on an Indicator’s legacy Details screen) or Indicators (if you clicked the Pivot button on a Group’s legacy Details screen) associated to the object from which you pivoted.
- A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.
Pivoting from a Tag
- On the top navigation bar, hover over Browse and select Tags. The Browse screen will display a results table containing Tags.
- Click on an entry to display its Details drawer.
- Click the vertical ellipsisat the upper-right corner of the drawer and select Pivot.
- After selecting Pivot, select whether to pivot on Indicators or Groups. The Browse screen will be displayed with the following elements on the screen:
- A results table containing Indicators or Groups to which the selected Tag is applied.
- A gray rectangle containing the name of the Tag from which you pivoted. This element will be displayed above the results table.
Pivoting from an Attribute
New Details Screen
- Navigate to the Details screen for an Indicator or Group.ImportantThe new Details screen is not currently available for Email, Signature, and Task Groups. As such, you can pivot from Attributes added to these Group types on the legacy Details screen only.
- Scroll down to view the Attributes card on the left side of the screen and click on an Attribute to display its details. The Pivot button will be displayed for the Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 2).
- Click an Attribute’s Pivot button to pivot from it. The Browse screen will be displayed with the following elements on the screen:
- A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
- A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.
Legacy Details Screen
- Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
- Scroll down to view the Attributes card on the left side of the screen (Figure 4). The Pivoticon will be displayed to the right of an Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 3).
- Click an Attribute's Pivoticon to pivot from it. The Browse screen will be displayed with the following elements on the screen:
- A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
- A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.
ThreatConnect® is a registered trademark of ThreatConnect, Inc.
20034-01 v.09.D
Was this article helpful?