Sourcing Data

Minimum Role: Organization role of Read Only User (for viewing Source Attributes); Organization role of Standard User (for creating, editing, and deleting Source Attributes)

Prerequisites: An Indicator, Group, Victim, or Victim Asset

Overview

Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect^® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

Using and Administrating Source Attributes

1. Navigate to the Details screen for an Indicator, Group, Victim, or Victim Asset (Host Indicator in this example).
2. Scroll down to the Attributes card on the left side of the screen (Figure 1). 

    

3. Click the Plus button at the upper-right corner of the Attributes card. The Edit Attribute window will be displayed (Figure 2). 

    

   • Select a Type: Select Source as the Attribute type.
   • Default: After selecting Source as the Attribute type, the Default checkbox will be displayed below the Select a Type dropdown menu. Objects can have multiple Source Attributes. If desired, select this checkbox to make this Attribute the default Source Attribute.
   • Choose Security Labels: Select any Security Labels to apply to the Source.
   • Attribute Source: Select an existing Attribute Source from the dropdown menu, or enter a new one.
   • Save Source: Select this checkbox to add the Source as an option in the Attribute Source dropdown menu so that it may be used again by the owner.
   • Text Box: Enter a description for the Source or its URL, either in plain text or Markdown.
     Note

     If there is no URL for the Source, such as when an Indicator is obtained from a listserv, this box can be left blank.
4. The Source Attribute will be displayed in the Attributes card (Figure 3). 

    

5. To edit or delete a Source Attribute, click Edit or Delete for the Source in the Attributes card, respectively.

Default Source Attribute

If you added the Source Attribute to an Indicator and selected the Default checkbox, it will also be displayed on the Indicator’s Description/Source card (Figure 4).

If no default Source has been added to an Indicator, click Click here to add one. in the Description/Source card to create one (Figure 5).

The Edit Attribute window (Figure 2) will be displayed with Source selected as the Attribute type and the Default checkbox selected. Fill out the remaining fields as outlined in Step 3 of the “Using and Administrating Source Attributes” section.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20017-01 v.08.C