Pivoting on Data

Overview

Pivoting is an analytic transition in which you move from one entity—Indicators and Groups in the ThreatConnect^® Data Model, as well as Tags and Attributes—to an associated entity as defined by the Diamond Model. Through pivoting, you can explore relationships and find correlations between entities in a contiguous manner.

Before You Start

Pivoting from an Indicator or Group

There are three areas in ThreatConnect where you can pivot from an Indicator or Group: the Details drawer, the new Details screen, and the legacy Details screen.

Details Drawer

1. On the top navigation bar, hover over Browse and select Indicators, Groups, or a specific Indicator or Group type. The Browse screen will display a results table containing objects of the selected type.
2. Click on an entry to display its Details drawer.
3. Click the vertical ellipsisat the upper-right corner of the drawer and select Pivot. The Browse screen will be displayed with the following elements on the screen (Figure 1):
   • A results table containing all Groups (if you selected Pivot on an Indicator’s Details drawer) or Indicators (if you selected Pivot on a Group’s Details drawer) associated to the object from which you pivoted.
   • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.
   

    

New Details Screen

1. Navigate to the Details screen for an Indicator or Group.
2. Click the Optionsbutton at the top right of the screen and select Pivot. The Browse screen will be displayed with the following elements on the screen:
   • A results table containing all Groups (if you selected Pivot on an Indicator’s Details screen) or Indicators (if you selected Pivot on a Group’s Details screen) associated to the object from which you pivoted.
   • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.

Legacy Details Screen

1. Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
2. Click the Pivot button at the top left of the screen. The Browse screen will be displayed with the following elements on the screen:
   • A results table containing all Groups (if you clicked the Pivot button on an Indicator’s legacy Details screen) or Indicators (if you clicked the Pivot button on a Group’s legacy Details screen) associated to the object from which you pivoted.
   • A gray rectangle containing the summary of the object from which you pivoted. This element will be displayed above the results table.

Pivoting from a Tag

1. On the top navigation bar, hover over Browse and select Tags. The Browse screen will display a results table containing Tags.
2. Click on an entry to display its Details drawer.
3. Click the vertical ellipsisat the upper-right corner of the drawer and select Pivot.
4. After selecting Pivot, select whether to pivot on Indicators or Groups. The Browse screen will be displayed with the following elements on the screen:
   • A results table containing Indicators or Groups to which the selected Tag is applied.
   • A gray rectangle containing the name of the Tag from which you pivoted. This element will be displayed above the results table.

Pivoting from an Attribute

New Details Screen

1. Navigate to the Details screen for an Indicator or Group.
   Important

   The new Details screen is not currently available for Email, Signature, and Task Groups. As such, you can pivot from Attributes added to these Group types on the legacy Details screen only.
2. Scroll down to view the Attributes card on the left side of the screen and click on an Attribute to display its details. The Pivot button will be displayed for the Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 2).

   

    

3. Click an Attribute’s Pivot button to pivot from it. The Browse screen will be displayed with the following elements on the screen:
   • A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
   • A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.

Legacy Details Screen

1. Navigate to the Overview tab of the legacy Details screen for an Indicator or Group.
2. Scroll down to view the Attributes card on the left side of the screen (Figure 4). The Pivoticon will be displayed to the right of an Attribute if the maximum character length for its Attribute Type is 500 or less (Figure 3).

   

    

3. Click an Attribute's Pivoticon to pivot from it. The Browse screen will be displayed with the following elements on the screen:
   • A results table containing all objects with an Attribute matching the selected Attribute’s type and value.
   • A gray rectangle containing the type and value of the Attribute from which you pivoted. This element will be displayed above the results table.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20034-01 v.09.D