[FormIntake] document the feature (#13731)#14713
Open
nino-filigran wants to merge 5 commits intomasterfrom
Open
[FormIntake] document the feature (#13731)#14713nino-filigran wants to merge 5 commits intomasterfrom
nino-filigran wants to merge 5 commits intomasterfrom
Conversation
Open
nino-filigran
changed the title
nino-filigran
changed the title
| # Create knowledge via Form Intake | ||
|
|
||
|
|
||
| It allows administrators to design structured forms that analysts fill out to quickly create STIX entities, relationships, and observables — without navigating complex creation dialogs. |
Member
There was a problem hiding this comment.
Suggested change
| It allows administrators to design structured forms that analysts fill out to quickly create STIX entities, relationships, and observables — without navigating complex creation dialogs. | |
| The Form Intake allows administrators to design structured forms that analysts fill out to quickly create STIX entities, relationships, and observables ready for knowledge ingestion — without navigating complex creation dialogs. |
|
|
||
| It allows administrators to design structured forms that analysts fill out to quickly create STIX entities, relationships, and observables — without navigating complex creation dialogs. | ||
|
|
||
| ## Key capabilities |
Member
There was a problem hiding this comment.
Suggested change
| ## Key capabilities | |
| ## Key features |
|
|
||
| ## Key capabilities | ||
|
|
||
| - Visual form designer with field configuration and reordering 16 supported field types (text, date, select, toggle, lookup, vocabulary, etc.) |
Member
There was a problem hiding this comment.
Suggested change
| - Visual form designer with field configuration and reordering 16 supported field types (text, date, select, toggle, lookup, vocabulary, etc.) | |
| - Visual form designer with field configuration and reordering of 16 supported field types (text, date, select, toggle, lookup, vocabulary, etc.) |
| - Visual form designer with field configuration and reordering 16 supported field types (text, date, select, toggle, lookup, vocabulary, etc.) | ||
| - Field width control (full, half, third) | ||
| - 4 entity creation modes: Single, Multiple, Parsed, and Lookup | ||
| - Additional entities and relationships in a single form |
Member
There was a problem hiding this comment.
What do we mean by Additional, do these have a special meaning -e.g. non-required/optional
| - Field width control (full, half, third) | ||
| - 4 entity creation modes: Single, Multiple, Parsed, and Lookup | ||
| - Additional entities and relationships in a single form | ||
| - STIX bundle generation from submissions |
Member
There was a problem hiding this comment.
Suggested change
| - STIX bundle generation from submissions | |
| - Generate STIX bundle from submissions |
| - Visual form designer with field configuration and reordering 16 supported field types (text, date, select, toggle, lookup, vocabulary, etc.) | ||
| - Field width control (full, half, third) | ||
| - 4 entity creation modes: Single, Multiple, Parsed, and Lookup | ||
| - Additional entities and relationships in a single form |
Member
There was a problem hiding this comment.
Suggested change
| - Additional entities and relationships in a single form | |
| - Add additional entities and relationships in a single form |
| ## Prerequisites & Permissions | ||
| More details on our [Role-Based access control here](../administration/users.md) | ||
|
|
||
| |Action |Details |Required Capability| Override of capabilities in draft (EE) | |
Member
There was a problem hiding this comment.
Once the other PR is changed the 'Override of capabilities in draft' will be changed to 'Control of capabilities in Draft mode'
| |View form intakes list| |Manage ingestion or Create / Update knowledge|Create / Update knowledge (creation forced to draft)| | ||
|
|
||
|
|
||
| When draft creation is enforced, form submissions create entities in a draft workspace for review before publication. |
Member
There was a problem hiding this comment.
Suggested change
| When draft creation is enforced, form submissions create entities in a draft workspace for review before publication. | |
| When draft creation is enforced, form submissions create entities in a draft workspace for review before publication to knowledge. |
|
|
||
|
|
||
| When draft creation is enforced, form submissions create entities in a draft workspace for review before publication. | ||
| Administrators can optionally allow users to override draft mode per submission. |
Member
There was a problem hiding this comment.
Suggested change
| Administrators can optionally allow users to override draft mode per submission. | |
| Administrators can optionally allow users to skip draft mode per submission. |
|
|
||
| When draft creation is enforced, form submissions create entities in a draft workspace for review before publication. | ||
| Administrators can optionally allow users to override draft mode per submission. | ||
| The form intake button is hidden when the user lacks Authorized Members update rights in draft context. See Enterprise Edition for details on capability overrides in draft. |
Member
There was a problem hiding this comment.
Suggested change
| The form intake button is hidden when the user lacks Authorized Members update rights in draft context. See Enterprise Edition for details on capability overrides in draft. | |
| The form intake button is hidden when the user does not have 'Authorized Members update' rights in draft context. See Enterprise Edition for details on controlling users capabilities in draft mode. |
|
|
||
|
|
||
| ## Defining a Form Intake | ||
| To create a form intake, go in the Ingestion menu, Form intake menu and click on Create. |
Member
There was a problem hiding this comment.
Suggested change
| To create a form intake, go in the Ingestion menu, Form intake menu and click on Create. | |
| To create a form intake, navigate to the Ingestion menu, Form intake menu and click Create. |
| ## Defining a Form Intake | ||
| To create a form intake, go in the Ingestion menu, Form intake menu and click on Create. | ||
|
|
||
| Multiple fields are offered to you: |
Member
There was a problem hiding this comment.
Suggested change
| Multiple fields are offered to you: | |
| You can set core detail fields: |
| Multiple fields are offered to you: | ||
| - Name of your form intake | ||
| - Description of the form intake | ||
| - Active (toggle on/off, default to on): when activated, your form will be present in the list. |
Member
There was a problem hiding this comment.
Suggested change
| - Active (toggle on/off, default to on): when activated, your form will be present in the list. | |
| - Active (toggle on/off, default to on): when activate, your form will be present in the form intake list. |
| - Active (toggle on/off, default to on): when activated, your form will be present in the list. | ||
|
|
||
| ## Main entity definition | ||
| Defining a main entity has two goals: |
Member
There was a problem hiding this comment.
Suggested change
| Defining a main entity has two goals: | |
| Defining a main entity sets two variables: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #14713 +/- ##
==========================================
+ Coverage 32.36% 32.48% +0.12%
==========================================
Files 3096 3101 +5
Lines 210896 214327 +3431
Branches 38196 39069 +873
==========================================
+ Hits 68262 69631 +1369
- Misses 142634 144696 +2062
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
|
||
| ## Main entity definition | ||
| Defining a main entity has two goals: | ||
| - Be able to define in which screen, in addition to the import menu, you will see your form intake (ex: if your main entity is a Report, on the Report List view, you will see your form intake) |
Member
There was a problem hiding this comment.
Suggested change
| - Be able to define in which screen, in addition to the import menu, you will see your form intake (ex: if your main entity is a Report, on the Report List view, you will see your form intake) | |
| - The entity view where the form intake will be available, this is in addition to the import menu. E.g. if your main entity is a Report, you will see your form intake in the Report List view. |
| ## Main entity definition | ||
| Defining a main entity has two goals: | ||
| - Be able to define in which screen, in addition to the import menu, you will see your form intake (ex: if your main entity is a Report, on the Report List view, you will see your form intake) | ||
| - Be able to specify which entity you want to create first (especially useful if it's a container.) |
Member
There was a problem hiding this comment.
Suggested change
| - Be able to specify which entity you want to create first (especially useful if it's a container.) | |
| - Which entity you want to create first, this is especially useful for a container entity. |
| - Be able to define in which screen, in addition to the import menu, you will see your form intake (ex: if your main entity is a Report, on the Report List view, you will see your form intake) | ||
| - Be able to specify which entity you want to create first (especially useful if it's a container.) | ||
|
|
||
| By default, main entity selected is a **Report**. |
Member
There was a problem hiding this comment.
Suggested change
| By default, main entity selected is a **Report**. | |
| By default, the main entity selected is a **Report**. |
| ### Common fields | ||
|
|
||
| For each main entity, you can configure multiple fields: | ||
| - **Entity Lookup** (disabled by default): if enabled, users will not be able to create any new entity, but will be forced to choose among existing entities. Another field will appear if you enable this field: **Disable on-the-fly entity creation** |
Member
There was a problem hiding this comment.
Suggested change
| - **Entity Lookup** (disabled by default): if enabled, users will not be able to create any new entity, but will be forced to choose among existing entities. Another field will appear if you enable this field: **Disable on-the-fly entity creation** | |
| - **Entity Lookup** (disabled by default): if enabled, users will will be forced to choose from existing entities. Another field will appear when you enable this field: **Disable on-the-fly entity creation** |
|
|
||
| For each main entity, you can configure multiple fields: | ||
| - **Entity Lookup** (disabled by default): if enabled, users will not be able to create any new entity, but will be forced to choose among existing entities. Another field will appear if you enable this field: **Disable on-the-fly entity creation** | ||
| - **Disable on-the-fly entity creation** (disabled by default): if you want your users to select some entities among existing ones, you may face an issue, if the entity they want to create does not exist. Enable this option to prevent from being able to create entity on the fly, to ensure strict entity lookup. |
Member
There was a problem hiding this comment.
Suggested change
| - **Disable on-the-fly entity creation** (disabled by default): if you want your users to select some entities among existing ones, you may face an issue, if the entity they want to create does not exist. Enable this option to prevent from being able to create entity on the fly, to ensure strict entity lookup. | |
| - **Disable on-the-fly entity creation** (disabled by default): Enable this If you want your users to only select an existing entity. |
| For each main entity, you can configure multiple fields: | ||
| - **Entity Lookup** (disabled by default): if enabled, users will not be able to create any new entity, but will be forced to choose among existing entities. Another field will appear if you enable this field: **Disable on-the-fly entity creation** | ||
| - **Disable on-the-fly entity creation** (disabled by default): if you want your users to select some entities among existing ones, you may face an issue, if the entity they want to create does not exist. Enable this option to prevent from being able to create entity on the fly, to ensure strict entity lookup. | ||
| - **Allow multiple instances of main entity** (disabled by default): if you want to allow your users multiple times the same entity. If you enable this field, another field will appear **Multiple Mode**. |
Member
There was a problem hiding this comment.
Suggested change
| - **Allow multiple instances of main entity** (disabled by default): if you want to allow your users multiple times the same entity. If you enable this field, another field will appear **Multiple Mode**. | |
| - **Allow multiple instances of main entity** (disabled by default): Enable this if you want to allow your users to be able to enter the same entity multiple times. When enabled **Multiple instances mode** will appear. |
| - **Disable on-the-fly entity creation** (disabled by default): if you want your users to select some entities among existing ones, you may face an issue, if the entity they want to create does not exist. Enable this option to prevent from being able to create entity on the fly, to ensure strict entity lookup. | ||
| - **Allow multiple instances of main entity** (disabled by default): if you want to allow your users multiple times the same entity. If you enable this field, another field will appear **Multiple Mode**. | ||
|
|
||
| #### Create multiple instances |
Member
There was a problem hiding this comment.
Suggested change
| #### Create multiple instances | |
| #### Multiple Mode for Main Entity |
| - **Allow multiple instances of main entity** (disabled by default): if you want to allow your users multiple times the same entity. If you enable this field, another field will appear **Multiple Mode**. | ||
|
|
||
| #### Create multiple instances | ||
| Create multiple instances of the same entity type is possible by enabling the above options. |
Member
There was a problem hiding this comment.
Suggested change
| Create multiple instances of the same entity type is possible by enabling the above options. | |
| When enabled multiple instances of the same entity type can be created. |
docs/docs/usage/form-intake.md
Outdated
| When you add a relation, you need to choose: | ||
| - the Source entity (identified in the form by its label) | ||
| - the Target entity (identified in the form by its label) | ||
| - the relationship type (enabled as soon as Source & Target are provided) |
Member
There was a problem hiding this comment.
Suggested change
| - the relationship type (enabled as soon as Source & Target are provided) | |
| - the relationship type (select as soon as Source & Target are provided) |
docs/docs/usage/form-intake.md
Outdated
|
|
||
| ## Finalizing the submission: draft or not | ||
|
|
||
| You have the option, within the main entity, to enable an option **Create as draft by default**. If this option is enabled, another will be offered to your users: **Allow users to uncheck draft mode**. |
Member
There was a problem hiding this comment.
Suggested change
| You have the option, within the main entity, to enable an option **Create as draft by default**. If this option is enabled, another will be offered to your users: **Allow users to uncheck draft mode**. | |
| You have the option, within the main entity, to enable an option **Create as draft by default**. If this option is enabled, you can then choose to **Allow users to uncheck draft mode**. |
docs/docs/usage/form-intake.md
Outdated
|
|
||
| You have the option, within the main entity, to enable an option **Create as draft by default**. If this option is enabled, another will be offered to your users: **Allow users to uncheck draft mode**. | ||
|
|
||
| This has been built to offer the advanced users the option to directly submit their input to the main database instead of a draft. |
Member
There was a problem hiding this comment.
Suggested change
| This has been built to offer the advanced users the option to directly submit their input to the main database instead of a draft. | |
| This has been built to offer advanced users the option to directly submit their input to the main database instead of a draft. |
docs/docs/usage/form-intake.md
Outdated
|
|
||
| This has been built to offer the advanced users the option to directly submit their input to the main database instead of a draft. | ||
|
|
||
| However, if your user is only able to create data via draft, due to the [capability specific to draft (entreprise edition)](../administration/users.md) whatever you selected, the user will not able to untick the box. |
Member
There was a problem hiding this comment.
Suggested change
| However, if your user is only able to create data via draft, due to the [capability specific to draft (entreprise edition)](../administration/users.md) whatever you selected, the user will not able to untick the box. | |
| However, if your user is only able to create data via draft, due to the [user's specific draft capabilities (entreprise edition)](../administration/users.md) then the user will not able to untick the box. |
docs/docs/usage/form-intake.md
Outdated
| - Import dialog — Select "Import using a Form" in the import file dialog (displays full-width). | ||
| - Ingestion/form intake: when you click directly on the form intake you created, the form is prompted to you. | ||
|
|
||
| Note: The form intake button is hidden if the user lacks Create/update capability. |
Member
There was a problem hiding this comment.
Suggested change
| Note: The form intake button is hidden if the user lacks Create/update capability. | |
| Note: The form intake button is hidden if the user does not have Create/update capabilities. |
docs/docs/usage/form-intake.md
Outdated
| 7 Import bundle Imports into OpenCTI directly, or into a draft workspace if draft mode is enabled | ||
|
|
||
| ## Export | ||
| Export a form definition as a JSON file via the kebab menu → Export. |
Member
There was a problem hiding this comment.
Suggested change
| Export a form definition as a JSON file via the kebab menu → Export. | |
| Export a form definition as a JSON file via the options (kebab) menu → Export. |
docs/docs/usage/form-intake.md
Outdated
| Does not export previously submitted data. | ||
|
|
||
| ## Import | ||
| Import a form definition from a JSON file via the Form Intakes list page. |
Member
There was a problem hiding this comment.
Suggested change
| Import a form definition from a JSON file via the Form Intakes list page. | |
| Import a form definition from a JSON file via the Form Intake list page. |
docs/docs/usage/form-intake.md
Outdated
| Note: Verify version compatibility when importing across different OpenCTI versions. | ||
|
|
||
| ## Delete | ||
| Delete via the kebab menu → Delete. Deletion is permanent and cannot be undone. |
Member
There was a problem hiding this comment.
Suggested change
| Delete via the kebab menu → Delete. Deletion is permanent and cannot be undone. | |
| Delete via the options (kebab) menu → Delete. Deletion is permanent and cannot be undone. |
docs/docs/usage/form-intake.md
Outdated
| - Start simple: Begin with essential fields and iterate based on analyst feedback. | ||
| - Use Parsed mode for bulk IOCs: Comma or line-separated input is the fastest approach for high-volume observable ingestion. | ||
| - Set field widths strategically: Use third for short fields (dates, scores, markings), full for text areas. | ||
| - Mark only truly essential fields as required: Reduce friction for analysts while maintaining data quality. |
Member
There was a problem hiding this comment.
Suggested change
| - Mark only truly essential fields as required: Reduce friction for analysts while maintaining data quality. | |
| - Mark only truly essential fields as required - reduces friction for analysts while maintaining data quality. |
tobybutler405
requested changes
Mar 3, 2026
Member
tobybutler405
left a comment
tobybutler405
left a comment
There was a problem hiding this comment.
Hi Nino, I've made suggested changes to improve readability and keep it in line with the draft style guide. See what you think.
Co-authored-by: tobybutler405 <10601168+tobybutler405@users.noreply.github.com>
Co-authored-by: tobybutler405 <10601168+tobybutler405@users.noreply.github.com>
Co-authored-by: tobybutler405 <10601168+tobybutler405@users.noreply.github.com>
Clarified instructions on defining relationships in the form, including the required switch for automatic relation creation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Related issues
Checklist
Further comments