---
title: "Case Associations Overview | ThreatConnect"
slug: "case-associations-overview"
description: "This article provides an overview of a Workflow Case's Associations and Potential Associations cards. It also provides the minimum roles and prerequisites for Case associations."
tags: ["Case Management", "Connecting Data"]
updated: 2024-02-08T13:16:07Z
published: 2024-02-08T13:16:07Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Case Associations Overview

The **Associations**card of a [Workflow Case](https://knowledge.threatconnect.com/v1/docs/workflow-cases) displays all Indicators, Groups, and Cases associated to the Case. For Indicators and Groups displayed on a Case’s **Associations**card, the Case will be listed as an associated Case on the [**Cases**card](https://knowledge.threatconnect.com/docs/the-associations-tab#cases) of the [**Associations**tab](https://knowledge.threatconnect.com/docs/the-associations-tab) on their **[](https://knowledge.threatconnect.com/docs/the-details-screen)** [](https://knowledge.threatconnect.com/docs/the-details-screen)[**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) [](https://knowledge.threatconnect.com/docs/the-details-screen)**[](https://knowledge.threatconnect.com/docs/the-details-screen)** and the [**Associations**card](https://knowledge.threatconnect.com/docs/the-associations-card) on their [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy). Cases associated to one another will be displayed on each other’s **Associations**card when viewing the Case.

On a Case's **Potential Associations** card, you can view Indicators, Groups, and Cases suggested as associations that you may want to add to the Case. Some or all of the following objects may be displayed on this card, depending on how your System Administrator configured potential associations for your ThreatConnect® instance:

- Indicators that match the type and summary of a Case [Artifact](https://knowledge.threatconnect.com/docs/artifacts) that has its **[](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case)**[](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case)[**Use to potentially associate cases.**checkbox](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case)[](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case)**[](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case)**selected
- Indicators associated to Groups associated to the Case
- Groups associated to Indicators associated to the Case
- Groups associated to Indicators that match the type and summary of a Case Artifact that has its **Use to potentially associate cases.**checkbox****selected
- Cases that share an Artifact with the Case you are viewing (i.e., both Cases contain an Artifact with the same summary and type, and each copy of the Artifact has its **Use to potentially associate cases.**checkbox****selected)

## Before You Start

| Minimum Role(s) | - Organization role of Read Only User (for viewing Indicators, Groups, and Cases associated to, and potentially associated to, a Case) - Organization role of Standard User (for associating Indicators, Groups, and Cases to, and dissociating them from, a Case) - Organization role of Organization Administrator (for performing actions listed in the **Bulk Action**dropdown menu on potentially associated Cases) |
| --- | --- |
| Prerequisites | - Workflow enabled by a System Administrator - A [Workflow Case created in your Organization](https://knowledge.threatconnect.com/v1/docs/creating-cases) - Cross-owner associations enabled by a System Administrator (for creating associations between Cases in your Organization and Groups and Indicators in Communities and Sources to which you have access) - Potential Case associations enabled by an Organization Administrator for a Community or Source to which you have access (for Indicators and Groups in the Community or Source to be suggested as potential associations to a Case) |

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20124-01 v.06.A

## Related

- [Artifacts](/artifacts.md)
- [Associations](/associations.md)
- [Parts of a Case](/parts-of-a-case.md)
- [The Cases Screen](/the-cases-screen.md)
- [The Details Screen](/the-details-screen.md)
- [Workflow Overview](/workflow-overview.md)