Removing Objects From Threat Graph

Overview

The Threat Graph feature in ThreatConnect^® provides a graph-based interface that you can use to discover, visualize, and contextualize associations and relationships between Indicators, Groups, Cases, and Tags. As you pivot in Threat Graph and add objects to the graph, you may want to remove objects that are irrelevant or no longer of interest to you. Doing so helps declutter the graph and ensure you focus on the objects that matter most to your investigation.

Before You Start

User Roles

• To remove objects from Threat Graph, your user account can have any Organization role.

Removing Graph Objects

The Graph Objects drawer (Figure 1) provides two ways to select and remove objects from Threat Graph:

• The Selection Actions menu (remove one or more objects)
• The Options (⋯) menu for an object (remove one object)

Selection Actions Menu

Follow these steps to use the Selection Actions menu on the Graph Objects drawer to remove one or more objects from Threat Graph:

1. Open Threat Graph.
2. Ensure there is at least one other node on the graph in addition to the origin node, as you cannot remove the origin node. If there are no other nodes on the graph except for the origin node, pivot in ThreatConnect, CAL™, or an enrichment service to add nodes.
3. Click View Table in the Threat Graph header to open the Graph Objects drawer.
4. Select objects in the table on the Graph Objects drawer using the following methods:
   • Select individual objects: Select the checkbox to the left of an object’s value in the Type column to select the object.
   • Select multiple objects at once: Select the checkbox to the left of the Type column header to select all objects on the current table page.
     
     Hint

     Selections on one page persist when you navigate to another page, allowing you to select items across multiple pages.
5. Click Selection Actions at the top left of the Graph Objects drawer and select Remove from graph to remove the selected objects and their corresponding nodes from the graph.

Options Menu

Follow these steps to use an object’s ⋯ menu on the Graph Objects drawer to remove the object from Threat Graph:

1. Open Threat Graph.
2. Ensure there is at least one other node on the graph in addition to the origin node, as you cannot remove the origin node. If there are no other nodes on the graph except for the origin node, pivot in ThreatConnect, CAL, or an enrichment service to add nodes.
3. Click View Table in the Threat Graph header to open the Graph Objects drawer.
4. On the Graph Objects drawer, click the ⋯ menu for an object that does not correspond to the origin node and select Remove from graph to remove the object and its corresponding node from the graph.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20117-15 v.01.A