Case Associations Overview
  • 08 Feb 2024
  • 1 Minute to read
  • Dark
    Light

Case Associations Overview

  • Dark
    Light

Article summary

The Associations card of a Workflow Case displays all Indicators, Groups, and Cases associated to the Case. For Indicators and Groups displayed on a Case’s Associations card, the Case will be listed as an associated Case on the Cases card of the Associations tab on their Details screen and the Associations card on their legacy Details screen. Cases associated to one another will be displayed on each other’s Associations card when viewing the Case.

On a Case's Potential Associations card, you can view Indicators, Groups, and Cases suggested as associations that you may want to add to the Case. Some or all of the following objects may be displayed on this card, depending on how your System Administrator configured potential associations for your ThreatConnect® instance:

  • Indicators that match the type and summary of a Case Artifact that has its Use to potentially associate cases. checkbox selected
  • Indicators associated to Groups associated to the Case
  • Groups associated to Indicators associated to the Case
  • Groups associated to Indicators that match the type and summary of a Case Artifact that has its Use to potentially associate cases. checkbox selected
  • Cases that share an Artifact with the Case you are viewing (i.e., both Cases contain an Artifact with the same summary and type, and each copy of the Artifact has its Use to potentially associate cases. checkbox selected)

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing Indicators, Groups, and Cases associated to, and potentially associated to, a Case)
  • Organization role of Standard User (for associating Indicators, Groups, and Cases to, and dissociating them from, a Case)
  • Organization role of Organization Administrator (for performing actions listed in the Bulk Action dropdown menu on potentially associated Cases)
Prerequisites
  • Workflow enabled by a System Administrator
  • A Workflow Case created in your Organization
  • Cross-owner associations enabled by a System Administrator (for creating associations between Cases in your Organization and Groups and Indicators in Communities and Sources to which you have access)
  • Potential Case associations enabled by an Organization Administrator for a Community or Source to which you have access (for Indicators and Groups in the Community or Source to be suggested as potential associations to a Case)

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20124-01 v.06.A


Was this article helpful?