mirror of
https://github.com/OpenCTI-Platform/opencti.git
synced 2025-12-22 08:17:08 +00:00
[docs] Bulk Search: massive operations (#376)
This commit is contained in:
Binary file not shown.
|
Before Width: | Height: | Size: 74 KiB |
BIN
docs/docs/usage/assets/bulk-search-known.png
Normal file
BIN
docs/docs/usage/assets/bulk-search-known.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
BIN
docs/docs/usage/assets/bulk-search-unknown-import.png
Normal file
BIN
docs/docs/usage/assets/bulk-search-unknown-import.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
BIN
docs/docs/usage/assets/bulk-search-unknown.png
Normal file
BIN
docs/docs/usage/assets/bulk-search-unknown.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 25 KiB After Width: | Height: | Size: 53 KiB |
@@ -51,7 +51,7 @@ The bulk search capabilities is available in the top bar of the platform and all
|
||||
|
||||

|
||||
|
||||
When searching in bulk, OpenCTI is only looking for an exact match in some properties:
|
||||
When searching in bulk, OpenCTI is only looking for an case-insensitive exact match in some properties:
|
||||
|
||||
* `name`
|
||||
* `aliases`
|
||||
@@ -60,15 +60,34 @@ When searching in bulk, OpenCTI is only looking for an exact match in some prope
|
||||
* `value`
|
||||
* `subject`
|
||||
* `abstract`
|
||||
* `x_opencti_additional_names`
|
||||
* `account_login`
|
||||
* `account_type`
|
||||
* `attribute_key`
|
||||
* `card_number`
|
||||
* `iban`
|
||||
* `hashes.MD5`
|
||||
* `hashes.SHA-1`
|
||||
* `hashes.SHA-256`
|
||||
* `hashes.SHA-512`
|
||||
* `x_opencti_additional_names`
|
||||
* `path`
|
||||
* `persona_name`
|
||||
* `url`
|
||||
* `user_id`
|
||||
|
||||
When something is not found, it appears in the list as `Unknown` and will be excluded if you choose to export your search result in a JSON STIX bundle or in a CSV file.
|
||||
Found entities are listed in the `Known entities` panel. You can export them or launch massive operations on them, like in other entities lists.
|
||||
|
||||

|
||||
|
||||
When something is not found, it appears in the `Unknown entities` tab.
|
||||
You can quickly add some of these unknown values in the platform: select the wanted unknown values, and click on the 'Create unknown entities' button in the toolbar.
|
||||
|
||||

|
||||
|
||||
You are redirected to the `Import data` pop-up, prefilled with a file containing the selected unknown values. You can continue the steps, create a file, add it in a draft, etc.
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
## Contextual search
|
||||
|
||||
|
||||
Reference in New Issue
Block a user