Quick Answer Management

Access Quick Answers

Quick answers are a resource available to analysts from the left panel of any previously created notebook.

Create a Quick Answer

You can create quick answers from two areas of the console:

• In a notebook, point to a free cell and enter the quick answer code. A quick answer takes a single cell.

• Click the icon. A page opens that prompts you to enter the quick answer name, a description, one or more tags to make it easier to search for the quick answer, and the MITRE category for the tactic and technique used.

Click OK. The quick answer is added to the relevant category in the Quick Answers panel on the left side of the notebook.

Or:

• In the top menu, select Settings. In the left panel, select Quick answers.

• Click Add quick answer. A new entry is added at the end of the list.

• Select the quick answer to add code to it.

Copy a Quick Answer

• In the top menu, select Settings. In the left panel, select Quick answers.

• Click the icon for the quick answer you want to copy. A copy of the quick answer is made, with the text string “[Copy] - “ prepended to its name.

To edit a quick answer created by Cytomic, you must first copy it. You cannot directly edit a quick answer published by Cytomic.

Delete a Quick Answer

• Go to the Quick answers panel on the left side of a notebook. Select the quick answer you want to delete. In the lower-left corner, a sub-panel opens that shows the quick answer name and description.

• Click the icon. A confirmation dialog box opens. Click OK. The quick answer is deleted from the panel.

When an analyst deletes a quick answer, it cannot be accessed by any of the MSSP/MDR vendor/SOC accounts. You cannot undo this action. Use it carefully.

Publish a Quick Answer

• In the top menu, select Settings. In the left panel, select Quick answers.

• Click the drop-down menu. Select Published.

After you publish a quick answer, it can be accessed by all of the MSSP/MDR vendor/SOC accounts. If the quick answer is Not Published, it can be accessed only by the analyst account that created it.

Edit a Quick Answer Attributes

• To edit the name, tags, or description of a quick answer, click the attribute and enter the new value.

• In the case of tags, a drop-down menu appears that shows all available tags. To create a new tag, enter its value in the Tags field. The new tag is added to the drop-down menu for all created quick answers.

Edit a Quick Answer Content

Click the quick answer. The notebook content opens. After you have edited the content, click the button in the notebook toolbar, or press Ctrl+s.

Add the Code Contained in a Quick Answer to a Notebook

To add the code contained in a quick answer to a notebook:

• Click the cell where you want to add the quick answer code.

• Click the icon associated with the quick answer, or double-click the quick answer name. The quick answer code is added to the selected cell.

• To view the information associated with a quick answer, click the quick answer name. A panel appears in the lower-left corner that shows the quick answer name and description.

• To insert the quick answer code in a new cell, click the Insert content link. A cell with the new content is created immediately after the selected cell.

• If the quick answer requires parameters, a dialog box opens that shows the name of the parameters and the data type you are expected to specify.