---
title: "Associations Card for Cases | ThreatConnect"
slug: "associations-card-for-cases"
description: "This article describes how to view Indicators, Groups, and Cases associated to a Workflow Case and add associations via the Case’s Associations card."
tags: ["Case Management", "Connecting Data"]
updated: 2024-05-17T18:59:21Z
published: 2024-05-17T18:59:21Z
---
> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Associations Card for Cases
Figure 1 shows an example of the **Associations**card for a Case, which is located below the [**Attributes**card](https://training.threatconnect.com/learn/article/workflow-cases-case-attributes-kb-article) on the right side of the screen displaying the Case. You can collapse and expand the **Associations**card by hovering the cursor anywhere in the card and clicking the arrow displayed at the upper-right corner of the card.
## Indicators
Expand the **Indicators** section to display all Indicators manually associated to the Case you are viewing (Figure 2). Each Indicator’s type, [CAL score](https://knowledge.threatconnect.com/docs/threatassess-and-cal), [Indicator Status](https://knowledge.threatconnect.com/docs/indicator-status), [ThreatAssess score](https://knowledge.threatconnect.com/docs/threatassess-and-cal), and creation date will be displayed in the table.
To view the owner(s) to which an Indicator belongs, click the **arrow.png)**icon to the right of its summary.
### Viewing Indicator Details
Select an owner in the **arrow**.png)dropdown to display the [**Details** drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) for the Indicator in that owner. You can also click the link in the **Summary** column or select **Details**from the vertical ellipsis to the right of an Indicator’s table entry to display the **Details** drawer for the Indicator in the owner listed at the top of the **arrow**.png)dropdown.
### Adding Indicator Associations
To add a new associated Indicator to the Case, click the **New… **button at the upper-right corner of the Case and select **Associate Indicator**, or click **Add Indicators**at the top right of the **Indicators**section. The **Add Related Intelligence** drawer will be displayed, showing all available Indicators that are not associated to the Case (Figure 3).
- Select one or more Indicators to associate to the Case. If desired, use the **FILTERS**selector to filter Indicators by type, owner, a range of dates within which Indicators were [last modified](https://knowledge.threatconnect.com/docs/the-last-modified-date), or a range of dates within which Indicators were created. You can also enter text in the box to the right of the **FILTERS**selector to filter Indicators by summary. To view the **Details**drawer for an Indicator, click its summary in the **Summary**column.
- Click the **ADD SELECTED**button. The selected Indicator(s) will be associated to the Case and added to the **Indicators** table on the **Associations**card.NoteAll copies of a selected Indicator in all owners to which you have access will be added as associations, even if you select a copy in only one owner. For example, if a **bad.com** Host Indicator exists in your Organization, a Community, and a Source and you select only the copy in the Community, all three copies of **bad.com** will be added as associations.
### Removing Indicator Associations
To dissociate an Indicator from a Case, select **Dissociate**from the vertical ellipsis to the right of an Indicator’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.
NoteWhen you dissociate an Indicator from a Case, all copies of the Indicator in all owners will be dissociated.
## Groups
Expand the **Groups** section to display all Groups, categorized by type, manually associated to the Case you are viewing (Figure 4). When a Group type’s section is expanded, the summary and creation date for each Group of that type will be displayed..
NoteCampaigns and Threats are displayed at the top of the section with an orange bar to the left and are expanded by default in order to prioritize them.
To view the owner(s) to which a Group belongs, click the **arrow.png)**icon to the right of its summary.
### Viewing Group Details
Select an owner in the **arrow** **.png)**dropdown to display the [**Details** drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) for the Group in that owner. You can also click the link in the **Summary** column or select **Details**from the vertical ellipsis to the right of a Group’s table entry to display the **Details** drawer for the Group in the owner listed at the top of the **arrow.png)**dropdown.
### Adding Group Associations
To add a new associated Group to the Case, click the **New… **button at the upper-right corner of the Case and select **Associate Group**, or click **Add Groups**at the top right of the **Groups**section. The **Add Related Intelligence** drawer will be displayed, showing all available Groups (Figure 5).
- Select one or more Groups to associate to the Case. If desired, use the **FILTERS**selector to filter Groups by type owner, a range of dates within which Groups were [last modified](https://knowledge.threatconnect.com/docs/the-last-modified-date), or a range of dates within which Groups were created. You can also enter text in the box to the right of the **FILTERS**selector to filter Groups by summary. To view the **Details**drawer for a Group, click its summary in the **Summary**column.
- Click the **ADD SELECTED**button. The selected Group(s) will be associated to the Case and added to the**Groups** table on the **Associations**card.NoteAll copies of a selected Group in all owners to which you have access will be added as associations, even if you select a copy in only one owner. For example, if a **Bad Guy** Adversary Group exists in your Organization, a Community, and a Source and you select only the copy in the Community, all three copies of **Bad Guy** will be added as associations.
### Removing Group Associations
To dissociate a Group from a Case, select **Dissociate** from the vertical ellipsis to the right of a Group’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.
NoteWhen you dissociate a Group from a Case, all copies of the Group in all owners will be dissociated.
## Cases
Expand the **Cases** section to display all Cases manually associated to the Case you are viewing (Figure 6).
### Viewing Case Details
Click the Case’s name, or select **Details**from the vertical ellipsis to the right of the Case’s table entry, to open the Case in a new browser tab.
### Adding Case Associations
To add a new associated Case, click the **New… **button at the upper-right corner of the Case and select **Associate Case**, or click **Add Cases**at the top right of the **Cases**section. The **Add Related Cases** drawer will be displayed, showing all available Cases (Figure 7).
- Select one or more Cases to associate to the Case you are viewing. If desired, use the **FILTERS**selector, the default display menu, or the box to the right of the **FILTERS**selector to filter the displayed Cases. For more information on how to filter Cases using these options, see the [“Filtering Cases” section of *Viewing, Managing, and Filtering Cases*](/v1/docs/viewing-managing-and-filtering-cases#filtering-cases).
- Click the **ADD SELECTED**button. The selected Case(s) will be associated to the Case and added to the**Cases** table on the **Associations**card for the Case.
### Removing Case Associations
To dissociate a Case from the Case you are viewing, select **Dissociate**from the vertical ellipsis to the right of a Case’s table entry. The dissociation will happen immediately, and you will not be prompted for confirmation.
---
*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*
20124-02 v.05.A