Case Attributes
  • 14 Feb 2024
  • 4 Minutes to read
  • Dark
    Light

Case Attributes

  • Dark
    Light

Article Summary

Overview

Case Attributes are key/value data sets that you can add to a Workflow Case. These Attributes enrich a Case’s data and aid security teams as they investigate a threat and determine the appropriate escalation path for a Case.

The Attributes card of a Workflow Case displays all System-level and Organization-level Attributes added to the Case. This article describes how to add Attributes to a Case, edit existing Attributes added to a Case, and remove Attributes from a Case.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing Case Attributes)
  •  Organization role of Standard User (for creating, updating, and deleting Case Attributes)
Prerequisites
  • Workflow enabled by a System Administrator
  • At least one Attribute Type created for Cases at the System or Organization level
  • A Workflow Case created in your Organization (see Creating Cases)

Attributes Card

Figure 1 shows an example of the Attributes card for a Case, which is located below the Case Details card on the right side of the screen displaying the Case.

Note
To collapse or expand the Attributes card, hover the cursor anywhere in the card and click the arrow displayed at the upper-right corner of the card.

Graphical user interface, application  Description automatically generated

 

If no Attributes have been added to a Case, the text No attributes in this case. Click to add an attribute. will be displayed (Figure 2).

Graphical user interface, text, application, email  Description automatically generated

 

Adding Attributes to a Case

If no Attributes have been added to a Case, click the No attributes in this case. Click to add an attribute. text (Figure 2). The Add Attribute drawer will be displayed (Figure 3).

If at least one Attribute has been added to a Case, click the New… Diagram  Description automatically generated button at the upper-right corner of the Case and select Attribute, or hover the cursor over the Attributes card and click the plus Icon  Description automatically generated icon at the upper-right corner of the card. The Add Attribute drawer will be displayed (Figure 3).

Graphical user interface, application  Description automatically generated

 

  • Type: Select an Attribute Type. By default, there are no pre-configured Attributes for Cases. This means that this dropdown menu will be empty unless Attribute Types for Cases are created in the System or Organization in which the Case resides.
  • Create a new attribute type: Click this link to create an Attribute Type for a Case. The Org Config screen for the Organization in which the Case resides will open in a new browser tab. See Creating Custom Attribute Types  for more information about creating custom Attribute Types at the Organization level.
    Note
    Only users with a System role of Administrator can create Attribute Types at the System level. Similarly, only users with a System role of Operations Administrator or an Organization role of Organization Administrator can create Attribute Types at the Organization level.
    Note
    If you create a custom Attribute Type via the Create a new attribute type link, you must refresh the screen displaying the Case after creating the Attribute Type for it to be listed in the Type dropdown menu.

After an Attribute Type is selected from the Type dropdown in Figure 3, fields to enter the Attribute’s Value and Source will be displayed in the Add Attribute drawer (Figure 4).

Graphical user interface, text, application, email  Description automatically generated

 

  • Value: Enter the Attribute’s value. Note that the type of field displayed (e.g., text box, dropdown menu, spinner) depends on the Validation Rule selected during the creation of the custom Attribute Type.
  • Source: Enter the Attribute’s source.
  • Click the SAVE button. The Attribute will be added to the Case and displayed in the Attributes card.

If the Allow Markdown checkbox was selected when creating a custom Attribute Type for a Case, a Preview Markdown  link will be displayed above the Value text box (Figure 5). This link indicates that the Value text box supports Markdown.

Graphical user interface, application  Description automatically generated

 

Note
If you use Markdown to add an image, a thumbnail image will be displayed in the Attribute. Hover over the image to display an option for viewing the image in full screen.

If you try to add an Attribute to a Case when the Attribute Type’s Max Allowed limit has been reached, an error message will be displayed stating that the maximum number of times that the Attribute Type (Phishing Open Rate in this example) can be added to the current Case has been exceeded (Figure 6).

Graphical user interface, text, application, email  Description automatically generated

 

Select a different Attribute Type, or remove an existing Attribute of the maxed-out Attribute Type from the Case. For instructions on how to remove an existing Attribute from a Case, see the “Removing Attributes from a Case” section.

Editing Attributes

To edit an Attribute added to a Case, click the vertical ellipsis displayed to the right of the Attribute in the Attributes card (Figure 1) and select Edit. The Edit Attribute drawer will be displayed (Figure 7).

Graphical user interface, application, Teams  Description automatically generated

 

  • Make any desired changes to the Attribute’s Value or Source.
  • Click the SAVE button.

Alternatively, hover the cursor over the Attribute’s Value or Source in the Attributes card (Figure 1) to display a pencil A close up of a device  Description automatically generated icon to the right of the label. Click this icon to edit the Attribute’s Value or Source, respectively. After making the desired changes, click the checkmark A picture containing table  Description automatically generatedicon to save the changes (Figure 8).

Chart  Description automatically generated

 

Removing Attributes from a Case

To remove an Attribute from a Case, click the vertical ellipsis displayed to the right of the Attribute in the Attributes card (Figure 1) and select Remove. The Confirm Remove Attribute window will be displayed. Click the CONFIRM button to remove the selected Attribute from the Case.


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20125-01 v.01.C


Was this article helpful?