Adding Intelligence Data to a Report

You can use Intelligence Data sections to capture basic details about a Group, its Attributes, and objects associated to it in a report.

To add an Intelligence Data section to a report, click the + Add Section button along the top of the Report Editor, or click the + Add Above or + Add Below button when hovering over an existing section added to the report, and then select an Intelligence Data section (Figure 1). The only Intelligence Data section available is Group Data.

Group Data

Selecting Group Data in the Add Section drawer will display the Add Group Data menu (Figure 2).

Here, you can select any of the following Group Data section(s) to add to the report:

• Details
• Attributes
• Group Associations
• Indicator Associations
• Victim Assets Associations

Details

The Details section can be used to display basic information about the Group for which you are creating a report. To add this section to a report, select Details from the Add Group Data menu (Figure 2). The Details menu will be displayed (Figure 3).

• Details: To include all available Group data options in the Details section, select the Select All checkbox; otherwise, select the checkbox for each Group data option you want to include in the Details section. Available Group data options include the following:
  • Name: The Group’s name.
  • Type: The Group’s type.
  • Owner: The Organization, Community, or Source to which the Group belongs.
  • Security Label: The Security Label(s) applied to the Group.
  • Date Added: The date and time when the Group was created.
  • Last Modified: The date and time when the Group was last modified.
  • Tags: The Tag(s) applied to the Group.
• Section Preview: This section displays a preview of the Details section that will be added to the report.
• Click one of the following buttons to add the Details section to the report:
  • Add: Click this button to add the section to the report and close the Add New Section drawer.
  • Add & Select Another: Click this button to add the section to the report and return to the main menu of the Add Section drawer (Figure 1).

You can add only one Details section to a single report. If this section has been added to a report, an Editicon will be displayed to the right of the Details option in the Add Group Data menu (Figure 2). In this case, selecting Details will allow you to edit the configuration of the existing Details section.

Attributes

The Attributes section can be used to display the following information about Attributes added to a Group:

• The Attribute’s type
• Security Labels applied to the Attribute
• The Attribute’s source
• The date when the Attribute was created
• The date when the Attribute was last modified
• The Attribute’s value

To add this section to a report, select Attributes from the Add Group Data menu (Figure 2). The Attributes menu will be displayed (Figure 4).

• Select the checkbox for each Attribute to add to the report. To select all Attributes, including those displayed on other pages in the table, select the checkbox in the table’s header. If desired, use the Filters menu to filter Attributes by Attribute Type, a range of dates within which they were created, or a range of dates within which they were last modified. You can also enter text in the box to the left of the Filters menu to filter Attributes by value.
  Note

  If you select Attributes on multiple pages in the table, they will all be added to the report.
• : Click this icon to display a preview of the Attributes section that will be added to the report for the Attribute.
• Click one of the following buttons to add a separate Attributes section to the report for each selected Attribute:
  • Add: Click this button to add the section(s) to the report and close the Add New Section drawer.
  • Add & Select Another: Click this button to add the section(s) to the report and return to the main menu of the Add Section drawer (Figure 1).

Group Associations

The Group Associations section can be used to display information about Groups associated to the Group for which you are creating a report in a tabular format. To add this section to a report, select Group Associations from the Add Group Data menu (Figure 2). The Group Associations menu will be displayed (Figure 5).

• By default, Groups of all types belonging to any owner to which you have access will be displayed in the Associated Groups table. If desired, use the following options to filter associated Groups displayed in the table:
  • Type: Select one or more Group types. Only Groups of the selected type(s) will be displayed in the table.
  • Owner: Select one or more owners. Only Groups that belong to the selected owner(s) will be displayed in the table.
  • Date Added: Click the from and to fields and use the date selectors to select the beginning and end of a date range, respectively. Only Groups that were created within the specified range will be displayed in the table.
  • Last Modified: Click the from and to fields and use the date selectors to select the beginning and end of a date range, respectively. Only Groups that were last modified within the specified range will be displayed in the table.
• Table Columns: By default, all available table columns will be displayed in the Associated Groups table. To prevent a table column from being displayed in the table, clear the checkbox corresponding to its name.
• Table Cutoff: Enter the maximum number of associated Groups to display in the Associated Groups table. The minimum value you can enter is 5, and the maximum value you can enter is 20.
• Sort By: Select the table column by which to sort associated Groups in the Associated Groups table.
  Note

  You can sort associated Groups by any table column, including those not displayed in the Associated Groups table.
• Ascending/Descending: Select whether to sort associated Groups display in the Associated Groups table in ascending or descending order. The sort order will correspond to the column by which the table is sorted.
• Section Preview: This section displays a preview of the Associated Groups table that will be added to the report.
• Click one of the following buttons to add the Group Associations section (i.e., the Associated Groups table) to the report:
  • Add: Click this button to add the section to the report and close the Add New Section drawer.
  • Add & Select Another: Click this button to add the section to the report and return to the main menu of the Add Section drawer (Figure 1).

You can add only one Group Associations section to a single report. If this section has been added to a report, an Editicon will be displayed to the right of the Group Associations option in the Add Group Data menu (Figure 2). In this case, selecting Group Associations will allow you to edit the configuration of the existing Group Associations section.

Indicator Associations

The Indicator Associations section can be used to display information about Indicators associated to the Group for which you are creating a report in a tabular format. To add this section to a report, select Indicator Associations from the Add Group Data menu (Figure 2). The Indicator Associations menu will be displayed (Figure 6).

• By default, Indicators of all types belonging to any owner to which you have access will be displayed in the Associated Indicators table. If desired, use the following options to filter associated Indicators displayed in the table:
  • Type: Select one or more Indicator types. Only Indicators of the selected type(s) will be displayed in the table.
  • Owner: Select one or more owners. Only Indicators that belong to the selected owner(s) will be displayed in the table.
  • Date Added: Click the from and to fields and use the date selectors to select the beginning and end of a date range, respectively. Only Indicators that were created within the specified range will be displayed in the table.
  • Last Modified: Click the from and to fields and use the date selectors to select the beginning and end of a date range, respectively. Only Indicators that were last modified within the specified range will be displayed in the table.
• Table Columns: By default, all available table columns will be displayed in the Associated Indicators table. To prevent a table column from being displayed in the table, clear the checkbox corresponding to its name.
• Table Cutoff: Enter the maximum number of associated Indicators to display in the Associated Indicators table. The minimum value you can enter is 5, and the maximum value you can enter is 20.
• Sort By: Select the table column by which to sort associated Indicators in the Associated Indicators table.
  Note

  You can sort associated Indicators by any table column, including those not displayed in the Associated Indicators table.
• Ascending/Descending: Select whether to sort associated Indicators displayed in the Associated Indicators table in ascending or descending order. The sort order will correspond to the column by which the table is sorted.
• Section Preview: This section displays a preview of the Associated Indicators table that will be added to the report.
• Click one of the following buttons to add the Indicator Associations section (i.e., the Associated Indicators table) to the report:
  • Add: Click this button to add the section to the report and close the Add New Section drawer.
  • Add & Select Another: Click this button to add the section to the report and return to the main menu of the Add Section drawer (Figure 1).

You can add only one Indicator Associations section to a single report. If this section has been added to a report, an Editicon will be displayed to the right of the Indicator Associations option in the Add Group Data menu (Figure 2). In this case, selecting Indicator Associations will allow you to edit the configuration of the existing Indicator Associations section.

Victim Assets Associations

The Victim Assets Associations section can be used to display information about Victim Assets associated to the Group for which you are creating a report in a tabular format. To add this section to a report, select Victim Assets Associations from the Add Group Data menu (Figure 2). The Victim Assets Associations menu will be displayed (Figure 7).

• Type: By default, Victim Assets of all types will be displayed in the Associated Victim Assets table. If desired, select one or more Victim Asset types. Only associated Victim Assets of the selected type(s) will be displayed in the table.
• Table Columns: By default, all available table columns will be displayed in the Associated Victim Assets table. To prevent a table column from being displayed in the table, clear the checkbox corresponding to its name.
• Table Cutoff: Enter the maximum number of associated Victim Assets to display in the Associated Groups table. The minimum value you can enter is 5, and the maximum value you can enter is 20.
• Sort By: Select the table column by which to sort associated Victim Assets in the Associated Victim Assets table.
  Note

  You can sort associated Victim Assets by any table column, including those you chose not to display in the Associated Victim Assets table.
• Ascending/Descending: Select whether to sort associated Victim Assets displayed in the Associated Victim Assets table in ascending or descending order. The sort order will correspond to the column by which the table is sorted.
• Section Preview: This section displays a preview of the Associated Victim Assets table that will be added to the report.
• Click one of the following buttons to add the Victim Assets Associations section (i.e., the Associated Victim Assets table) to the report:
  • Add: Click this button to add the section to the report and close the Add New Section drawer.
  • Add & Select Another: Click this button to add the section to the report and return to the main menu of the Add Section drawer (Figure 1).

You can add only one Victim Assets Associations section to a single report. If this section has been added to a report, an Editicon will be displayed to the right of the Victim Assets Associations option in the Add Group Data menu (Figure 2). In this case, selecting Victim Assets Associations will allow you to edit the configuration of the existing Victim Assets Associations section.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20144-03 v.01.A