Adding a new research graph element

This section explains how you can add objects and relationships to a research graph.

Adding objects to research graphs

The following objects can be added to research graphs:

• Hash. On the research graph, the object is identified with an MD5 hash.
• IP address. The object identifier on the research graph is the IP address.
• Domain name. The object identifier on the research graph is the host name.
• Web address. On the research graph, the object is identified by its web address.
• Actor. On the research graph, the object is identified by the actor's name.
• Report. On the research graph, reports are identified by their names.

  Note that the reports can be added to the graph only if they are permitted in your license. Please see all terms and conditions in your contract with Kaspersky.

• Custom object. These objects are unknown to Kaspersky Threat Intelligence Portal but relevant for your investigation (for example, infrastructure objects). On the research graph, custom objects are identified by the names you specified.

To add an object through Object lookup:

1. Create a new research graph or open an existing research graph for editing.
2. In the Object lookup field, specify the object you want to add to the research graph.
3. In the Search only in subsection, select the section for the object search from the following options:
   • IOC (selected by default)
   • Reports
   • Actors

   The specified object is added to a research graph with the related objects.

   If the specified object is not found, you can add a custom object manually (see the procedure below) or edit the search request. For actors, Kaspersky Threat Intelligence Portal searches for an exact name match.

   Note that the Threat Lookup quota is reduced when you specify the object to look for and then add it to the research graph. The number of available quotas is displayed under the filled-in Object lookup field.

To add an object manually:

1. Create a new research graph or open an existing research graph for editing.
2. Click the Create object button () on the left side of the graph editor window.

   If you search for an object and it is not found, the Create object button is also displayed in the Object lookup field.

3. In the window that opens, select the type of new object in the Object type drop-down list: Hash, Host, URL, IP, Actor, Report, or Custom.
4. Select the status of the new object in the Node status drop-down list.
5. Enter the new node name.
6. If necessary, enter a comment for the node.
7. Click Create node to add the object node to the graph.

   Please note, the Summary and other sections are not displayed when you add a node manually.

If you try to add a node of the object that is already presented in the graph (for example, a file with the same hash), this new node will not be created. Instead, the existing node with the same parameter will be highlighted in the research graph for your attention. The existing nodes are highlighted regardless of the way you added objects to the research graph - through Object lookup or manually.

Adding relationships to research graphs

To add a new relationship:

1. Click the wand button () on the left side of the graph editor window to turn the relationships creation mode on.
2. Click the node you want to start a relationship from.
3. Click another node you want the relationship to reach.

   The relationship is created.

4. Click the wand button () to turn the relationships creation mode off.

Page top