--- title: "Group Alias Information in Threat Graph" slug: "group-alias-information-in-threat-graph" description: "This article describes how to view alias information for Groups that CAL knows of and combine Group nodes that share an alias in Threat Graph." tags: ["Viewing Data", "Connecting Data"] updated: 2024-09-18T15:32:29Z published: 2024-09-18T15:32:29Z canonical: "knowledge.threatconnect.com/group-alias-information-in-threat-graph" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Group Alias Information in Threat Graph ## Overview The Threat Graph feature in ThreatConnect® provides a graph-based interface that you can use to discover, visualize, and contextualize associations and relationships between [Indicators](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicators), [Groups](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#groups), [Cases](https://knowledge.threatconnect.com/docs/workflow-cases), and [Tags](https://knowledge.threatconnect.com/docs/applying-tags). The **CAL Alias Information**and **Combine Group Nodes by Alias**options in Threat Graph, available for Adversary, Intrusion Set, Malware, Threat, and Tool Groups [CAL](https://knowledge.threatconnect.com/v1/docs/threatassess-and-cal)™ knows of, let you view alias information for Groups and combine Group nodes that share an alias into a single node, respectively. ## Before You Start ### User Roles - To use the **CAL Alias Information**and **Combine Group Nodes by Alias**options in Threat Graph for Adversary, Intrusion Set, Malware, Threat, and Tool Groups in an Organization, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To use the **CAL Alias Information**and **Combine Group Nodes by Alias**options in Threat Graph for Adversary, Intrusion Set, Malware, Threat, and Tool Groups in a Community or Source, your user account can have any [Community role](https://knowledge.threatconnect.com/docs/community-roles) except Banned for that Community or Source. ### Prerequisites - To have access to the **CAL Alias Information**and **Combine Group Nodes by Alias**options in Threat Graph, turn on CAL for your ThreatConnect instance (must be a System Administrator to perform this action). ## CAL Alias Information Follow these steps to view known aliases for Adversary, Intrusion Set, Malware, Threat, and Tool Groups CAL knows of in Threat Graph: 1. [Open Threat Graph](https://knowledge.threatconnect.com/docs/viewing-an-object-in-threat-graph). 2. Select a node on the graph that corresponds to an Adversary, Intrusion Set, Malware, Threat, or Tool Group. If no such node is on the graph, pivot in [ThreatConnect](https://knowledge.threatconnect.com/docs/pivoting-in-threatconnect-in-threat-graph) or [CAL](https://knowledge.threatconnect.com/docs/pivoting-with-cal-in-threat-graph) to add one. 3. If information for the selected Group exists in CAL, the Group [node’s menu](https://knowledge.threatconnect.com/docs/viewing-an-object-in-threat-graph#threat-graph-node-menu-options) will include the **CAL Alias Information**option. Select **CAL Alias Information**  to view a scrollable list of known aliases for the selected Group. For example, Figure 1 shows alias information for the **Fancy Bear**Adversary Group and the **Threat Group-4127** Threat Group, which is identical for both Groups. ![Figure 1_Group Alias Information in Threat Graph_7.7.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Group%20Alias%20Information%20in%20Threat%20Graph_7.7.0.png) NoteNo action will occur when you select an alias in the **CAL Alias Information**submenu. ## Combine Group Nodes by Alias If multiple Group nodes in Threat Graph have similar alias information, you can use the **Combine Group Nodes by Alias**option to combine those individual nodes into a single, compound node. This arrangement provides a better understanding of which objects are related to Groups that are likely to be the same entity, as well as a cleaner visual depiction of the relationships between the Groups and their respective associated objects. Follow these steps to combine multiple Group nodes with similar alias information into a compound node in Threat Graph: 1. [Open Threat Graph](https://knowledge.threatconnect.com/docs/viewing-an-object-in-threat-graph). 2. Ensure there are at least two Adversary, Intrusion Set, Malware, Threat, or Tool Groups with similar alias information on the graph. For example, in Figure 2, there are nodes for the **Fancy Bear**Adversary Group and the **Threat Group-4127**Threat Group. Based on the alias information provided by CAL for each Group (Figure 1), these two Groups have similar alias information. If no such nodes are on the graph, pivot in [ThreatConnect](https://knowledge.threatconnect.com/docs/pivoting-in-threatconnect-in-threat-graph) or [CAL](https://knowledge.threatconnect.com/docs/pivoting-with-cal-in-threat-graph) to add nodes. ![Figure 2_Group Alias Information in Threat Graph_7.7.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Group%20Alias%20Information%20in%20Threat%20Graph_7.7.0.png) 3. Select one of the Group nodes with similar alias information, and then select **Combine Group Nodes by Alias**in the [node’s menu](https://knowledge.threatconnect.com/docs/viewing-an-object-in-threat-graph#threat-graph-node-menu-options). 4. On the **Combine Group Nodes by Alias**window (Figure 3), click **Combine Group Nodes** to combine individual Group nodes that correspond to any of the aliases listed in the window into a compound Group node. ![Figure 3_Group Alias Information in Threat Graph_7.7.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Group%20Alias%20Information%20in%20Threat%20Graph_7.7.0.png) ImportantCombining individual Group nodes affects only the instance of the graph you are viewing in Threat Graph. You cannot undo the grouping of individual Group nodes in Threat Graph. Figure 4 shows the same graph as in Figure 2, except the individual **Threat Group-4127**Threat Group and **Fancy Bear**Adversary Group nodes have been combined into a compound Group node.****Compound Group nodes are a blue rectangle that contains all individual Group nodes on the graph that are a known alias of a given Group, based on the alias information in CAL. They also have a node label with the name of the primary Group name that the individual Group nodes are aliases of (**APT28**in this example). ![Figure 4_Group Alias Information in Threat Graph_7.7.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Group%20Alias%20Information%20in%20Threat%20Graph_7.7.0.png) You can reposition a compound Group node on the graph by dragging the blue rectangle to the desired location. Similarly, you can reposition individual Group nodes within a compound Group node by dragging them to the desired location. The repositioned Group node will remain inside the compound Group node, but the size of the compound Group node will change based on the Group node’s new position. Within a compound Group node, you can pivot in [ThreatConnect](https://knowledge.threatconnect.com/docs/pivoting-in-threatconnect-in-threat-graph) and [CAL](https://knowledge.threatconnect.com/docs/pivoting-with-cal-in-threat-graph) for each individual Group node. When you pivot in ThreatConnect or CAL for an individual Group node within a compound Group node, associated and related nodes added to the graph will be connected to the compound Group node. HintTo view associations and CAL relationships for an individual Group node within a compound Group node, click **Legend**![Threat Graph Legend icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Threat%20Graph%20Legend%20icon.png)in the toolbar at the top left of the graph and clear the checkbox(es) for the other Group type(s) in the compound Group node. --- *ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.* 20117-05 v.05.A