Case Associations Overview

Minimum Role: Organization role of Read Only User (for viewing Indicators, Groups, and Cases associated to, and potentially associated to, a Case); Organization role of Standard User (for associating Indicators, Groups, and Cases to, and dissociating them from, a Case); Organization role of Organization Administrator (for performing actions listed in the Bulk Action dropdown menu on potentially associated Cases)

Prerequisites: Workflow enabled by a System Administrator; a Workflow Case created in your Organization; cross-owner associations enabled by a System Administrator (for creating associations between Cases in your Organization and Groups and Indicators in Communities and Sources to which you have access); potential Case associations enabled by an Organization Administrator for a Community or Source to which you have access (for Indicators and Groups in the Community or Source to be suggested as potential associations to a Case)

The Associations card of a Workflow Case displays all Indicators, Groups, and Cases that are associated to the Case you are viewing. For Indicators and Groups displayed on a Case’s Associations card, the Case you are viewing will be listed as an associated Case on the Associations card of their Details screen. Cases associated to one another will be displayed on each other’s Associations card when viewing the Case.

The Potential Associations card of a Workflow Case displays the following:

• Indicators and Groups in your Organization, and in Communities and Sources to which you have access and for which an Organization Administrator has enabled potential Case associations, that are associated to objects associated to the Case you are viewing (i.e., the objects on the Case’s Associations card)
• Indicators that match the type and summary of a Case Artifact that is a ThreatConnect^® Indicator type and Groups associated to those Indicators
• Cases that share an Artifact, associated Indicator, or associated Group with the Case you are viewing

In other words, this card displays second-level associations to the Case’s associated objects, suggesting them as potential first-level associations to add to the Case. It also suggests adding Indicators that match an Artifact’s type and summary, Groups associated to those Indicators, and Cases that share an Artifact, associated Indicator, or associated Group with the Case you are viewing as first-level associations to the Case.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20124-01 v.04.B