Associations Overview

An association, one of the most powerful features in ThreatConnect^®, models a relationship between two objects. Associating data empowers an analyst to pivot to related objects and further investigate their relationships to the primary object in the association. In ThreatConnect, you can

• associate Groups to Intelligence Requirements (IRs), Indicators, Victim Assets, and other Groups;
• associate Indicators to IRs, Groups, Victim Assets, and, using custom associations, other Indicators; and
• associate IRs to Indicators, Groups, and Victim Assets.

In addition, you can associate Groups, Indicators, and IRs to Workflow Cases and their Artifacts and vice versa. Creating these associations is one of the main ways to connect information gathered within a Case to your threat intelligence data. Lastly, you can leverage cross-owner associations to create associations between Groups and Indicators in your Organization and those in your Communities and Sources, allowing for greater visualization and insight into all of your data.

You can view, create, and manage associations on the Associations tab of the Details screen and the Associations card on the legacy Details screen. In addition, you can view associations on the Details drawer for threat intelligence data objects and use Threat Graph to discover, visualize, and create associations in a graph-based interface.

Before You Start

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20076-01 v.10.B