Case Associations Overview

Updated on 08 Feb 2024
1 Minute to read

Print
Dark

Light

Article summary

Did you find this summary helpful?

Thank you for your feedback!

The Associations card of a Workflow Case displays all Indicators, Groups, and Cases associated to the Case. For Indicators and Groups displayed on a Case’s Associations card, the Case will be listed as an associated Case on the Cases card of the Associations tab on their Details screen and the Associations card on their legacy Details screen. Cases associated to one another will be displayed on each other’s Associations card when viewing the Case.

On a Case's Potential Associations card, you can view Indicators, Groups, and Cases suggested as associations that you may want to add to the Case. Some or all of the following objects may be displayed on this card, depending on how your System Administrator configured potential associations for your ThreatConnect^® instance:

Indicators that match the type and summary of a Case Artifact that has its Use to potentially associate cases. checkbox selected
Indicators associated to Groups associated to the Case
Groups associated to Indicators associated to the Case
Groups associated to Indicators that match the type and summary of a Case Artifact that has its Use to potentially associate cases. checkbox selected
Cases that share an Artifact with the Case you are viewing (i.e., both Cases contain an Artifact with the same summary and type, and each copy of the Artifact has its Use to potentially associate cases. checkbox selected)

Before You Start

Minimum Role(s)	Organization role of Read Only User (for viewing Indicators, Groups, and Cases associated to, and potentially associated to, a Case) Organization role of Standard User (for associating Indicators, Groups, and Cases to, and dissociating them from, a Case) Organization role of Organization Administrator (for performing actions listed in the Bulk Action dropdown menu on potentially associated Cases)
Prerequisites	Workflow enabled by a System Administrator A Workflow Case created in your Organization Cross-owner associations enabled by a System Administrator (for creating associations between Cases in your Organization and Groups and Indicators in Communities and Sources to which you have access) Potential Case associations enabled by an Organization Administrator for a Community or Source to which you have access (for Indicators and Groups in the Community or Source to be suggested as potential associations to a Case)

Minimum Role(s)

Organization role of Read Only User (for viewing Indicators, Groups, and Cases associated to, and potentially associated to, a Case)
Organization role of Standard User (for associating Indicators, Groups, and Cases to, and dissociating them from, a Case)
Organization role of Organization Administrator (for performing actions listed in the Bulk Action dropdown menu on potentially associated Cases)

Prerequisites

Workflow enabled by a System Administrator
A Workflow Case created in your Organization
Cross-owner associations enabled by a System Administrator (for creating associations between Cases in your Organization and Groups and Indicators in Communities and Sources to which you have access)
Potential Case associations enabled by an Organization Administrator for a Community or Source to which you have access (for Indicators and Groups in the Community or Source to be suggested as potential associations to a Case)

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20124-01 v.06.A

Was this article helpful?

What's Next

Associations Card for Cases

Table of contents

Before You Start

Case Associations Overview

Before You Start

Related articles

What's Next