Case Attributes

Overview

Case Attributes are key/value data sets that you can add to a Workflow Case. These Attributes enrich a Case’s data and aid security teams as they investigate a threat and determine the appropriate escalation path for a Case.

The Attributes card of a Workflow Case displays all System-level and Organization-level Attributes added to the Case. This article describes how to add Attributes to a Case, edit existing Attributes added to a Case, and remove Attributes from a Case.

Before You Start

User Roles

• To view Case Attributes, your user account can have any Organization role except App Developer.
• To create, edit, and delete Case Attributes, your user account must have an Organization role of Standard User, Sharing User, or Organization Administrator.
• To create a new Attribute Type in your Organization for Cases, your user account must have a System role of Administrator or Operations Administrator or an Organization role of Organization Administrator.

Prerequisites

• To have access to Workflow, select the Enable Workflow checkbox on the Permissions tab of the Organization Information window for your Organization on the Organizations tab of the Account Settings screen (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action). 

Attributes Card

The Attributes card (Figure 1) is located below the Case Details card on the right side of the screen when viewing a Case.

Adding Attributes to a Case

Follow these steps to add an Attribute to a Case:

1. Hover over the Attributes card and click New Attribute. Alternatively, click New… at the upper-right corner of the Case and select Attribute. 
2. Fill out the fields on the Add Attribute (Figure 2) as follows:

• Type: (Required) Select an Attribute Type from the dropdown. 
  Important

  Organization Administrators can configure a limit on the number of Case Attributes of an Attribute Type in their Organization. If this limit has been reached for the selected Type, you must select a different Attribute Type or remove an existing Attribute of that Attribute Type from a Case in the Organization.

• Create a new Attribute Type: (Optional) Click this link to open the Org Config screen in a new browser tab. From this screen, you can create an Attribute Type in your Organization and configure it for Cases. After you have saved the new Attribute Type, refresh the screen with the Case to populate the new Attribute Type in the Type menu.

3. After you select an available Type, fill out additional fields in the Add Attribute drawer (Figure 3) as follows:

• Value: (Required) Enter or select the Attribute’s value. This field’s format (e.g., text box, radio buttons, etc.) depends on the Attribute Type’s configuration.
  Note

  A Preview Markdown link will be displayed to the right of the Value heading for Attribute Types that take text input and support Markdown. The Value text box supports the Marked library (https://marked.js.org).
• Source: (Optional) Enter the Attribute’s source.

4. Click SAVE to save the Case Attribute.

Case Attribute Administrative Options

Click Options ⋮ at the upper right of an Attribute to access the following administrative options for a Case Attribute:

• Edit: Select this option to edit the Case Attribute in the Edit Attribute window.
  Hint

  Hover over the field for the Case Attribute's value or the Source field and click Edit to edit the Case Attribute's data in the Attributes card.
• Remove: Select this option to delete the Case Attribute.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20125-01 v.02.A