Display all indicators/observables contained in reports which contain a specific entity

[SamuelHassine]

Use case

Display all indicators/observables contained in reports which contain a specific entity

Current Workaround

None.

Proposed Solution

For Threat Actor, Intrusion Set, Campaign, Malware, Tools, Channels, Vulnerability, Attack patterns, Narratives :

• MVP In Knowledge, add a view “Indicators” in the right just above “Observables”.
  • this view display the list of Indicators related to the Entity (same as the current Indicators tab BUT without the filter panel on the right (Pattern type, Observable type)
  • in the Filters of the new Indicators view, add:
    • a field for Pattern type (containing pattern types possibilities displayed in the Indicator tab)
    • a field for Observable type (containing observables types possibilities displayed in the Indicator tab)
• MVP In Knowledge/Observables view, add a button at the top right, just after the “relationships view” one.
  • when hover, it display “Contextual view”
  • when click, the list of Observables will contain also Observables that are contained in Reports that contains the Entity
  • in the list’s columns, add a column labeled Report, sortable, that will display for each result the name of the Report that contain the result.
• MVP In the new Knowledge/Indicators view, add the same button that will display Indicators contained in Reports that contains the Entity
• MVP Remove the Indicators tab.