Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Define threat opinions

Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Before you begin

Role required: sn_ti.admin

Procedure

  1. Navigate to All > Threat Intelligence > IoC Repository > Threat Opinions.

  2. Click New.

  3. Complete the fields in the form as appropriate.

    FieldDescription
    OpinionThe producer's opinion about the STIX object.
    ExplanationThe producer's explanation about the opinion.
    AuthorsSpecifies the name of the author (example, an analyst).
    SourceSpecifies the threat source from which this record is created.
    Source IDUnique identifier for this object in the threat source.
    Created Time in SourceSpecifies the time the object is created in the source.
    Modified Time in SourceSpecifies the time the object is modified in the source.
  4. Click Submit.

What to do next

Click any of the following related lists to view additional information about objects associated with the threat opinion.

Related Links and Related ListsDescription
Show RelationshipsOpens the STIX Visualizer where you can view the relationship of the STIX object.Show Relationships appears only when the object has an associated object.
Associated ObjectsList of objects the threat opinion applies to.
Associated IndicatorsList of indicators the threat opinion applies to.
Associated ObservablesLists observables associated with this object.

Parent Topic:Threat opinions