Pivoting on Data
  • 24 Jan 2024
  • 3 Minutes to read
  • Dark
    Light

Pivoting on Data

  • Dark
    Light

Article summary

Overview

Pivoting is an analytic transition in which you move from one entity—Indicators and Groups in the ThreatConnect® Data Model, as well as Tags and Attributes—to an associated entity as defined by the Diamond Model. Through pivoting, you can explore relationships and find correlations between entities in a contiguous manner.

Before You Start

Minimum Role(s)Organization role of Read Only User
PrerequisitesAn Indicator, Group, Tag, or Attribute created in one of your ThreatConnect owners

Pivoting from an Indicator or Group

There are three areas in ThreatConnect where you can pivot from an Indicator or Group: the Details drawer, the new Details screen, and the legacy Details screen.

Important
The new Details screen is not currently available for Email, Signature, and Task Groups. As such, you can pivot from these Group types on the Details drawer and legacy Details screen only.

Details Drawer

  1. On the top navigation bar, hover over Browse and select Indicators, Groups, or a specific Indicator or Group type. The Browse screen will display a results table containing objects of the selected type.
  2. Click on an entry to display its Details drawer.
  3. Click the vertical ellipsisVertical ellipsis_Blackat the upper-right corner of the drawer and select Pivot. The Browse screen will be displayed with the following elements on the screen (Figure 1):
    • A results table containing all Groups (if you selected Pivot on an Indicator’s Details drawer) or Indicators (if you selected Pivot on a Group’s Details drawer) associated to the object from which you pivoted.
    • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.
    Graphical user interface, application  Description automatically generated

     

New Details Screen

  1. Navigate to the Details screen for an Indicator or Group.
  2. Click the Optionsbutton at the top right of the screen and select Pivot. The Browse screen will be displayed with the following elements on the screen:
    • A results table containing all Groups (if you selected Pivot on an Indicator’s Details screen) or Indicators (if you selected Pivot on a Group’s Details screen) associated to the object from which you pivoted.
    • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.

Legacy Details Screen

  1. Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
  2. Click the Pivot button at the top left of the screen. The Browse screen will be displayed with the following elements on the screen:
    • A results table containing all Groups (if you clicked the Pivot button on an Indicator’s legacy Details screen) or Indicators (if you clicked the Pivot button on a Group’s legacy Details screen) associated to the object from which you pivoted.
    • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.

Pivoting from a Tag

  1. On the top navigation bar, hover over Browse and select Tags. The Browse screen will display a results table containing Tags.
  2. Click on an entry to display its Details drawer.
  3. Click the vertical ellipsisVertical ellipsis_Blackat the upper-right corner of the drawer and select Pivot.
  4. After selecting Pivot, select whether to pivot on Indicators or Groups. The Browse screen will be displayed with the following elements on the screen:
    • A results table containing Indicators or Groups to which the selected Tag is applied.
    • A gray rectangle containing the name of the Tag from which you pivoted. This element will be displayed above the results table.

Pivoting from an Attribute

New Details Screen

  1. Navigate to the Details screen for an Indicator or Group.
    Important
    The new Details screen is not currently available for Email, Signature, and Task Groups. As such, you can pivot from Attributes added to these Group types on the legacy Details screen only.
  2. Scroll down to view the Attributes card on the left side of the screen and click on an Attribute to display its details. The Pivot button will be displayed for the Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 2).

    Figure%202_Pivoting%20on%20Data_7.4.0

     

  3. Click an Attribute’s Pivot button to pivot from it. The Browse screen will be displayed with the following elements on the screen:
    • A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
    • A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.

Legacy Details Screen

  1. Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
  2. Scroll down to view the Attributes card on the left side of the screen (Figure 4). The PivotPivot icon_Blueicon will be displayed to the right of an Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 3).

    Figure 3_Pivoting on Data_7.1.1

     

  3. Click an Attribute's PivotPivot icon_Blueicon to pivot from it. The Browse screen will be displayed with the following elements on the screen:
    • A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
    • A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20034-01 v.09.D


Was this article helpful?