--- title: "Case Attributes | ThreatConnect" slug: "case-attributes" description: "This article describes how to add Attributes to a Case, edit existing Attributes added to a Case, and remove Attributes from a Case." tags: ["Enriching Data", "Case Management", "Markdown"] updated: 2025-04-03T07:48:57Z published: 2025-04-03T07:48:57Z canonical: "knowledge.threatconnect.com/case-attributes" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Case Attributes ## Overview Case Attributes are key/value data sets that you can add to a [Workflow Case](/v1/docs/workflow-cases). These Attributes enrich a Case’s data and aid security teams as they investigate a threat and determine the appropriate escalation path for a Case. The **Attributes**card of a Workflow Case displays all System-level and Organization-level Attributes added to the Case. This article describes how to add Attributes to a Case, edit existing Attributes added to a Case, and remove Attributes from a Case. ## Before You Start ### User Roles - To view Case Attributes, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) except App Developer. - To create, edit, and delete Case Attributes, your user account must have an Organization role of Standard User, Sharing User, or Organization Administrator. - To create a new Attribute Type in your Organization for Cases, your user account must have a [System role](https://knowledge.threatconnect.com/docs/threatconnect-system-roles-and-permissions) of Administrator or Operations Administrator or an Organization role of Organization Administrator. ### Prerequisites - To have access to Workflow, select the **Enable Workflow** checkbox on the **Permissions** tab of the **Organization Information** window for your Organization on the **Organizations** tab of the **Account Settings** screen (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action). ## Attributes Card The **Attributes**card (Figure 1) is located below the [**Case Details** card](https://knowledge.threatconnect.com/v1/docs/case-details) on the right side of the screen when viewing a Case. ![Screenshot of an attribute card](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Case%20Attributes_7.9.0.png) ## Adding Attributes to a Case Follow these steps to add an Attribute to a Case: 1. Hover over the **Attributes** card and click **New Attribute**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Plus icon_Gray.png). Alternatively, click **New…**![Diagram Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Add%20button.png) at the upper-right corner of the Case and select **Attribute**. 2. Fill out the fields on the **Add Attribute**(Figure 2) as follows: ![Screenshot of an add attribute](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Case%20Attributes_7.7.1.png) - **Type**: (Required) Select an Attribute Type from the dropdown. Important Organization Administrators can [configure](https://knowledge.threatconnect.com/docs/creating-custom-attribute-types) a limit on the number of Case Attributes of an Attribute Type in their Organization. If this limit has been reached for the selected **Type**, you must select a different Attribute Type or [remove](/v1/docs/case-attributes#case-attribute-administrative-options) an existing Attribute of that Attribute Type from a Case in the Organization. - **Create a new Attribute Type**: (Optional) Click this link to open the **Org Config** screen in a new browser tab. From this screen, you can [create an Attribute Type](https://knowledge.threatconnect.com/docs/creating-custom-attribute-types) in your Organization and configure it for Cases. After you have saved the new Attribute Type, refresh the screen with the Case to populate the new Attribute Type in the **Type** menu. 3. After you select an available **Type**, fill out additional fields in the **Add Attribute** drawer (Figure 3) as follows: ![Screenshot of an add attribute card of Open Rate type.](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Case%20Attributes_7.7.1.png) - **Value**: (Required) Enter or select the Attribute’s value. This field’s format (e.g., text box, radio buttons, etc.) depends on the Attribute Type’s configuration.NoteA **Preview Markdown![Markdown icon 7.8.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Markdown%20icon%207.8.2.png)******link will be displayed to the right of the **Value** heading for Attribute Types that take text input and support [Markdown](https://www.markdownguide.org/). The **Value** text box supports the Marked library ([https://marked.js.org](https://marked.js.org/)). - **Source**: (Optional) Enter the Attribute’s source. 4. Click **SAVE** to save the Case Attribute. ## Case Attribute Administrative Options Click **Options** **⋮** at the upper right of an Attribute to access the following administrative options for a Case Attribute: - **Edit**: Select this option to edit the Case Attribute in the **Edit Attribute**window.HintHover over the field for the Case Attribute's value or the **Source** field and click **Edit ![Edit File icon_App Builder](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20File%20icon_App%20Builder.png)** to edit the Case Attribute's data in the **Attributes** card. - **Remove:**Select this option to delete the Case Attribute. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20125-01 v.02.A ## Related - [Creating Custom Attribute Types](/creating-custom-attribute-types.md) - [Parts of a Case](/parts-of-a-case.md) - [Workflow Overview](/workflow-overview.md)