--- title: "Adding Artifacts to a Case | ThreatConnect" slug: "adding-artifacts-to-a-case" description: "This article describes how to add Artifacts to a Workflow Case." tags: ["Case Management", "Markdown"] updated: 2024-02-08T14:54:21Z published: 2024-02-08T14:54:21Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Adding Artifacts to a Case Follow these steps to create an Artifact and add it to a [Workflow Case](https://knowledge.threatconnect.com/docs/workflow-cases) in ThreatConnect®: 1. On the top navigation bar, hover over **Workflow** and select **Cases**. The [**Cases** screen](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases) will be displayed. 2. Select a Case on the **Cases**screen. A [detailed view of the Case](https://knowledge.threatconnect.com/docs/parts-of-a-case#viewing-a-case) will be displayed. 3. Click the **New… ![Add button](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Add%20button.png)**button at the top right of the Case and select **Artifact**, or hover the cursor over the [**Artifacts**card](https://knowledge.threatconnect.com/docs/artifacts-card) and click **New Artifact****![Plus icon_Gray](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Plus%20icon_Gray.png)**at the upper-right corner of the card. The **Create Artifact**drawer will be displayed (Figure 1). ![Figure%201_Adding%20Artifacts%20to%20a%20Case_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Adding%20Artifacts%20to%20a%20Case_7.4.0.png) - **Type**: Select the Artifact’s type. Available Artifact types include all ThreatConnect [Indicator types](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicator-types) and other data types determined by ThreatConnect and your System Administrator. - **Summary**: Enter the contents of the Artifact. If you selected a file-based Artifact type****from the **Type**dropdown, a **Drag and drop, or click to select a file.**box will be displayed that you can use to upload the desired file for the Artifact. - **Associated Task**: Select a Case [Task](https://knowledge.threatconnect.com/v1/docs/phases-and-tasks) with which to associate the Artifact, if desired. If you do not want to associate the Artifact with a Task, keep the default selection of **No Task**. - **Associated Fields**: If you associate an Artifact with a Task, you can associate the Artifact with a specific Task input field if the type of Artifact being created matches the Artifact type for which the input field is configured. Use the dropdown to select an input field for the associated Task. If the only option is **No Field**, then the Task selected in the **Associated Task**dropdown does not have any input fields whose associated Artifact type matches the type****selected in the **Type** dropdown. - **Note**: Enter a [Note](/v1/docs/case-notes), either in plain text or in [Markdown](https://www.markdownguide.org/), to link to the Artifact. If using Markdown, click the **Preview Markdown**![Markdown Icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Markdown%20Icon.png)link to preview the text with the rendered Markdown formatting.NoteThe **Note**text box supports the Marked library ([https://marked.js.org/](https://marked.js.org/)). - **Source**: The default value of the Artifact’s source is the username of the user creating the Artifact. If desired, edit this value. - **Use to potentially associate cases.**: Select this checkbox to allow ThreatConnect to use the Artifact to generate potential associations for [Cases](https://knowledge.threatconnect.com/v1/docs/potential-associations-card-for-cases), [Groups, and Indicators](https://knowledge.threatconnect.com/docs/the-associations-tab#potential-associations). NoteIf multiple Cases contain an Artifact with the same summary and type, and the **Use to potentially associate cases.**checkbox is selected for each copy of the Artifact, those Cases will be displayed in the **Cases**section of the [**Potential Associations** card](https://knowledge.threatconnect.com/v1/docs/potential-associations-card-for-cases) for each Case**.**Those Cases will also be listed in the **CASES**dropdown in the [**Links**column of the **Artifacts**card](https://knowledge.threatconnect.com/v1/docs/artifacts-card#links) for the Artifact.ImportantThe default setting for this checkbox may vary across Artifact types. Also, if a System Administrator has disallowed the Artifact from being used to potentially associate Cases, then selection of this checkbox will not have any effect. - Click the **CREATE**button. After you create an Artifact, it will be displayed in the Case’s Artifacts card. If you associated the Artifact with a Task and Task input field, the **Task**column of the **Artifacts**card will display the name of each item (Figure 2). The Artifact will also be populated in the associated input field for the associated Task. ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Adding%20Artifacts%20to%20a%20Case_7.4.0.png) If you selected **No Field**from the **Associated Fields**dropdown, only the associated Task will be displayed in the **Task**column of the **Artifacts**card, and a link to view the related Artifact will be added at the bottom of the **Task Artifacts**section of the associated Task (Figure 3). ![Graphical user interface, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Adding%20Artifacts%20to%20a%20Case_7.4.0.png) If no associated Task is selected, no value will be displayed in the **Task**column of the **Artifacts**card. NoteYou can also add an Artifact to a Task as a related Artifact by clicking the vertical ellipsis on the right side of the Task and selecting **Add Artifact**. By default, the **Create Artifact** drawer associates the Artifact to the first Task in the Case that has not yet been completed (i.e., the default entry in the **Associated Task** dropdown). To associate the Artifact to the Task from which the **Add Artifact** option was selected, change this selection. See the [“Add Artifact” section of Task Administrative Options](https://knowledge.threatconnect.com/v1/docs/task-administrative-options#add-artifact)**for more information. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20123-03 v.02.C