Table View: Potential Associations

When viewing the Associations card in table view, the Potential Associations section displays Workflow Cases and, for Groups only, Artifacts suggested as associations that you may want to add to the primary object (Figure 1).

Viewing Potentially Associated Artifacts

The Artifacts table, available for Groups only, displays Artifacts that have their Use to potentially associate cases. checkbox selected and meet one or both of the following conditions, depending on how your System Administrator configured potential associations for your ThreatConnect instance:

• The Artifact matches the summary and type of an Indicator associated to the Group (e.g., an Artifact whose type is Host and summary is bad.com will be suggested as an association for a Group associated to the bad.com Host Indicator). Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
• The Artifact is associated to an Indicator associated to the Group. Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.

When reviewing potential Artifact associations, you can click on the name of the Artifact’s Case to investigate both items further and decide whether to associate the Artifact to the Group.

Viewing Potentially Associated Cases

The Cases table, available for Groups and Indicators, displays Cases that meet one or both of the following conditions, depending on the object’s type and how your System Administrator configured potential associations for your ThreatConnect instance:

• Groups
  • The Case contains an Artifact that has its Use to potentially associate cases. checkbox selected and matches the summary and type of an Indicator associated to the Group (e.g., a Case that contains an Artifact whose type is Host and summary is bad.com will be suggested as an association for a Group associated to the bad.com Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
  • The Case is associated to an Indicator associated to the Group. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.
• Indicators
  • The Case contains an Artifact that has its Use to potentially associate cases. checkbox selected and matches the summary and type of the Indicator you are viewing (e.g., a Case that contains an Artifact whose type is Host and summary is bad.com will be suggested as an association for the bad.com Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
  • The Case is associated to a Group associated to the Indicator. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.

Creating an Association

To associate an Artifact or Case suggested as a potential association to the primary object, select Associate from the vertical ellipsis for the desired Artifact or Case. After the Artifact or Case is associated to the primary object, it will be removed from the Potential Associations section.

If at any point you dissociate an Artifact or Case that was suggested as a potential association from the primary object, it will be readded to the Artifacts or Cases table, respectively.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20076-12 v.11.A