This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Assess

Assessing News Items and Stories

Description

Assess is the analyst queue for collected Stories and News Items. It supports search, filtering, sorting, merging, bookmarks, report assignment, connector sharing, and review state changes.

Functionalities

Use the Assess sidebar search for Story text search inside the current Assess view. Use the global Omnisearch field to search across Stories, Reports, and Products, or to open Assess with filter tokens such as:

story: source:"CERT.at" tag:ransomware read:false range:last7

Filters

AssessFilters

Details:
  • First Day: The Story’s creation date, typically matching the oldest News Item’s “published date.”
  • Last Day: The Story’s update date, usually reflecting the latest addition or change.

For manually created stories, the “updated” timestamp is essentially the creation time. As a result, filtering by Last day for a manually created story will not return it, even if an older “published date” is set.

Assess filters include search text, source, source group, tag, language, read state, important state, report membership, relevance, cybersecurity classification, changed-by actor, date range, and sort order.

Users can save the current Assess filters from the Saved filters button. A saved filter can be marked as the default for the user profile. Dashboard shortcuts show saved Assess filters so frequently used queues can be opened directly. See Filter Lists and Saved Filters.

Items

News items collected by Collectors become visible in Assess. They can be grouped into Stories automatically by Bots or manually by analysts.

AssessStory

Detail view:

  • Relevance of item/aggregate can be changed with “up/down” buttons

Charts:

  • Each item displays a chart if data has been aggregated in the last 7 days.
  • Line and bar chart display the same data, which is the accumulation of items per day.
  • The y-axis of the line chart can be adapted and is the same for all charts in the current items list. Therefore, charts can be compared properly.

Story actions include marking read/unread, marking important, sharing to connectors, ungrouping, version history, deleting, editing, adding to reports, and bookmarking. Bulk actions are available after selecting stories; visible shortcuts include Shift+R for adding to a report and Shift+B for bookmarking.

Story import

Stories can be created manually or imported from JSON. Imports are useful for transferring data between Taranis AI instances or restoring exported analyst work.

Use metadata-free story exports for normal re-imports. Metadata-rich exports include internal tags, attributes, votes, relevance, and similar state; clean those fields before importing them into another instance unless you deliberately want to carry that state over.

Version history

Stories keep a revision history. Use Version History from the Story actions menu to inspect saved revisions and compare the changes between adjacent revisions. Revision diffs are intended for audit and troubleshooting; they do not currently provide rollback.

Bookmarks

Bookmark collections are private per user. A story can be bookmarked from its action menu, or selected stories can be added to an existing or new collection from the Assess toolbar. If a user bookmarks a single story before creating any collections, Taranis AI creates a default collection named Bookmarks.

The Assess page shows up to six bookmark collections in a compact bar. Use All bookmarks to open the full bookmark page, rename or delete collections, reorder them, and remove stories from a collection. Removing a story from a bookmark collection does not delete the story from Assess. See Bookmarks.

Story Edit Advanced View

The Story Edit view can expose AI assisted actions when advanced story options are enabled in user settings. Available actions include generating a summary and title, and running sentiment analysis. When sentiment attributes are present, the advanced view shows the story sentiment status.

1 - MISP Auto-Update

Automatically synchronize Stories to MISP events

MISP Auto-Update pushes Story changes to a selected MISP connector after five minutes without further changes. It is experimental.

Prerequisites

Enable it

  1. Open a Story for editing and select the Advanced layout.
  2. Under MISP auto-update, select a MISP connector and enable auto-update.
  3. Save the Story.

The initial push, and every later eligible change, is scheduled five minutes after the last change. Changing the connector reschedules the push; disabling auto-update cancels it.

Behavior

  • An unsent Story creates a MISP event on its first automatic push.
  • Existing events are updated only when owned by your organization. Auto-update skips unowned events.
  • External MISP proposals block automatic updates. The Story editor displays a link to the event; resolve the proposals, then change the Story to schedule another push. A successful automatic push clears the warning.
  • Share to Connector can still push manually, including when auto-update is blocked.
  • Enabled Stories show a badge on their cards. Inbound MISP and conflict-resolution changes do not trigger auto-update.

What is synchronized

  • Story title, description, comments, summary, tags, attributes, links, and event report.
  • Added and removed news items. Changes to an already-synced news item do not update its MISP object.

Story edits, news-item and tag changes, report membership changes, and Story-modifying bot operations schedule an update.

Troubleshooting

If no update occurs, confirm auto-update is enabled, the connector works with a manual push, your organization owns the existing event, and no proposal warning is shown. For a proposal warning, resolve the proposals and make another Story change.

2 - Filter Lists and Saved Filters

Use dynamic Assess filter lists and save reusable queues.

Assess filter lists are the dynamic option lists behind the sidebar filters. They are built from the current data in Taranis AI and include Sources, Source Groups, Tags, and Languages.

Assess filter lists

Filter lists are not manually maintained lists. The core API exposes them through /api/assess/filter-lists, and the frontend may cache them per user. Assessment changes invalidate the cached filter lists so new Sources, Tags, and Languages become available without a restart.

Use the sidebar to combine:

  • Search text and Tags.
  • Time presets or exact date ranges.
  • Sources and Source Groups.
  • Languages.
  • Read, Important, In Reports, and Relevance state.
  • Changed by, Cybersecurity status, and Sort order.

Saved filters

Saved filters store the current Assess sidebar state in the user’s profile. They are private to the user and are useful for recurring queues such as shift review, unread important Stories, or language-specific monitoring.

Saved filters dialog

Open Saved filters from the Assess sidebar. Saving requires at least one active filter. Saving with an existing saved-filter name updates it; saving duplicate filter criteria under another name is rejected.

One saved filter can be marked as the default. When a default exists, opening /assess without query parameters opens that queue automatically. Use /assess?reset=true to bypass the default and open the unfiltered Assess list.

Saved filters also appear as Dashboard shortcuts. Dashboard cards can be applied directly or deleted from the Dashboard.

3 - Bookmarks

Save private Story collections for follow-up work.

Bookmarks let each user keep private collections of Stories without changing the Stories themselves. They are useful for follow-up queues, handovers, and temporary research sets.

Bookmark collections

From Assess

Use the Story action menu to bookmark one Story. If the user has no bookmark collections yet, Taranis AI creates a default collection named Bookmarks.

For bulk work, select Stories in Assess and use Bookmark in the toolbar. The dialog can add selected Stories to an existing collection or create a new collection.

The Assess list shows up to six bookmark collections in the bookmark bar. Use All bookmarks to open the full bookmarks page.

Bookmarks page

The bookmarks page supports:

  • Creating a new collection.
  • Opening a collection.
  • Renaming a collection.
  • Dragging collections to reorder them.
  • Deleting a collection.

Deleting a bookmark collection only removes the collection. It does not delete the Stories from Assess.

Inside a collection, select Stories and use Remove selected to remove them from that collection. Story access still follows the user’s normal permissions and TLP visibility.