The Description Attribute

Overview

The Description Attribute can be used to provide a brief, high-level explanation of the nature of a threat intelligence object. This information is useful for future reference and enables team members to quickly comprehend the meaning of the threat intelligence they are viewing.

When creating a Description Attribute for an Indicator, Group, or Victim in ThreatConnect^®, you can set the Attribute as the default Description Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Description Attribute is displayed on the Details card of the Overview tab; on the legacy Details screen, an object’s default Description Attribute is displayed on the Description card of the Overview tab, in addition to the Attributes card. For Tags and Tracks, the concept of a default Description Attribute does not apply, as the Description for these objects is not captured in an Attribute.

Before You Start

Creating, Editing, and Deleting Descriptions

New Details Screen

On the new Details screen, you can view, create, and manage Description Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Event, Incident, Intrusion Set, Malware, Tactic, Task, Threat, Tool, Vulnerability Groups. You cannot view, create, and manage Descriptions for Document, Email, Report, and Signature Groups; Victims; Tags; and Tracks.

Indicators and Groups

Creating a Default Description

1. Navigate to the Details screen for an Indicator or Group.
2. On the Overview tab, click Editat the top right of the Details card, or click on the Description section of the Details card. The Description section will now be editable (Figure 1).

   

    

   • Description: Enter the Description Attribute’s value in plain text or Markdown. The goal of a good Description is to succinctly provide information on who, when, where, how, and why. When possible, use the Description Attribute to answer these questions, and reserve in-depth analysis for the Additional Analysis and Context Attribute.
     Note

     See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
   • Preview Markdown: If you used Markdown when entering the Description Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
   • Click Confirmat the top right of the Details card.

The object’s default Description Attribute will be displayed in the Description section of the Details card (Figure 2). On the new Details screen, the default Description Attribute is displayed on the Details card only; it is not displayed on the Attributes card. If you add another default Description Attribute to an object via the Attributes card, the new default Description Attribute will be displayed on the Details card, and the former default Description Attribute will be displayed in the Other Attributes section of the Attributes card.

Editing a Default Description

Click Editat the top right of the Details card, or click on the Description section of the Details card, make the desired changes to the default Description Attribute’s value, and then click Confirmat the top right of the Details card to save your changes.

Deleting a Default Description

Click Editat the top right of the Details card, or click on the Description section of the Details card, delete all contents in the Description text box, and then click Confirmat the top right of the Details card to save your changes. The Description section of the Details card will now display the text None specified, indicating that no default Description Attribute has been added to the object.

Legacy Details Screen

On the legacy Details screen, you can view, create, and manage Description Attributes for all Indicator types, all Group types, and Victims. You can also manage Descriptions for Tags and Tracks.

Indicators, Groups, and Victims

Creating a Default Description

1. Navigate to the legacy Details screen for an Indicator, Group, or Victim.
2. Scroll down to the Description card on the left side of the screen. If no default Description Attribute has been added to the object, a message stating “No Default Description entered.” will be displayed (Figure 3).

    

3. Click the Click here to add one. link in the Description card. The Edit Attribute window will be displayed (Figure 4).

    

   • Attribute Type: Keep the selection of Description.
   • Default: Keep this checkbox selected so that the Description Attribute is the default of its type and displayed in the Description card. If this checkbox is cleared, the Description Attribute will not be the default Attribute of its type and will be displayed in the Attributes card only.
   • Choose Security Labels: Select one or more Security Labels to apply to the Description Attribute, if desired.
   • Attribute Source: Select an existing Attribute source from the dropdown menu, or enter a new one.
   • Save Source: Select this checkbox to save a new Attribute source so it will be displayed as an option in the Attribute Source dropdown menu in the future for objects belonging to the same owner.
   • Text Box: Enter the Description Attribute’s value in plain text or Markdown. The goal of a good Description is to succinctly provide information on who, when, where, how, and why. When possible, use the Description Attribute to answer these questions, and reserve in-depth analysis for the Additional Analysis and Context Attribute.
     Note

     See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown and ThreatConnect Markup when creating Attributes on the legacy Details screen.
   • Click the SAVEbutton.
     Note

     If a SAVE AND NEW button is displayed at the lower-left corner of the Edit Attribute window, this indicates that the Indicator, Group, or Victim contains a placeholder default Attribute Type for which no value has been provided. Clicking this button will save the changes to the Description Attribute and reopen the Edit Attribute window for the placeholder default Attribute Type.

The default Description Attribute will be displayed in the Description card (Figure 5) and the Attributes card (Figure 6).

Editing a Default Description

Click Editfor the default Description Attribute in the Attributes card (Figure 6). The Edit Attribute window will be displayed (Figure 4). Edit the default Description Attribute as desired, and then click the SAVE button to save your changes. Any changes made to the default Description Attribute will be reflected in the Attributes and Description cards.

Deleting a Default Description

Click Deletefor the default Description Attribute in the Attributes card (Figure 6) to delete it. After an object’s default Description Attribute is deleted, the Description card will display a message stating “No Default Description entered.” (Figure 3).

Tags and Tracks

Creating a Description

1. Navigate to the legacy Details screen for a Tag or Track.
2. Click the Click here to enter a Descriptiontext in the Description card (Figure 7).
   

    

3. Enter a Description for the object in the text box, and click Saveto save it (Figure 8).
   

    

Editing a Description

Click the Description in the Description card, make the desired changes in the text box, and click Saveto save the changes.

Deleting a Description

Click the Description in the Description card, delete all contents in the text box, and click Saveto save the changes. The Description card will now display Click here to enter a Description.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20025-01 v.10.A