The Source Attribute

Updated on 27 Mar 2024
5 Minutes to read

Print
Dark

Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Overview

Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect^® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

When creating a Source Attribute for an Indicator, Group, or Victim in ThreatConnect, you can set the Attribute as the default Source Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Source Attribute is displayed on the Details card of the Overview tab; on the legacy Details screen, an object’s default Source Attribute is displayed on the Description/Source and Attributes cards of the Overview tab.

Note

The Source Attribute is a separate entity from an Attribute Source. The Source Attribute provides information about the source of an object, whereas an Attribute Source provides information about the source of an Attribute.

Before You Start

Minimum Role(s)	Organization role of Read Only User (for viewing Source Attributes) Organization role of Standard User (for creating, editing, and deleting Source Attributes)
Prerequisites	An Indicator, Group, or Victim created in one of your ThreatConnect owners

Creating, Editing, and Deleting Sources

New Details Screen

On the new Details screen, you can view, create, and manage Source Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Document, Event, Incident, Intrusion Set, Malware, Report, Tactic, Threat, Tool, Vulnerability Groups. The new Details screen is not available for Email, Signature, and Task Groups; and Victims.

Note

If a Source Attribute is displayed in the Default Attributes section of the Attributes card on the new Details screen, it is because an Organization Administrator or a Director in a Community or Source configured the Source Attribute Type as a default Attribute Type on the Attribute Preferences tab of the Organization Config or Community (or Source) Config screen, respectively. However, this default Source Attribute is independent of the one displayed on the Details card, and updating either one of these Source Attributes will not affect the other.

In this article, references to the default Source Attribute are for the default Source Attribute displayed on the Details card on the new Details screen.

Creating a Source

You can create and view the default Source Attribute for an object on the Details card of an object’s new Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Details Card

Navigate to the Details screen for an object.
Click Editat the top right of the Details card, or click on the Source section of the Details card. The Source section will now be editable (Figure 1).
- Source: Enter the Source Attribute’s value in plain text or Markdown. The goal of a good Source is to succinctly provide information on the origin of the object.
  Note
  See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
  Note
  The Source text box supports the Marked library (https://marked.js.org/).
- Preview Markdown: If you used Markdown when entering the Source Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
- Click Confirmat the top right of the Details card.

The object’s default Source Attribute will be displayed in the Source section of the Details card (Figure 2).

Figure 2_The Source Attribute_7.1.0

Attributes Card

You can create a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object by selecting Source as the Attribute Type in the Add Attribute window. Creating a general Source Attribute via this method will allow you to add an Attribute Source and Security Labels to the Attribute.

To display a general Source Attribute in the Pinned Attributes section of the Attributes card, select the Set as Pinned Attribute checkbox in the Add Attribute window; otherwise, the Attribute will be displayed in the Other Attributes section of the Attributes card.

Editing a Source

Details Card

Click Edit The Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, make the desired changes to the default Source Attribute’s value, and then click Confirm The Source Attribute_Confirm button at the top right of the Details card to save your changes.

Attributes Card

You can edit a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object. Editing a general Source Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the Attributes card.

Deleting a Source

Details Card

You can delete the default Source Attribute from the Details card on the new Details screen for an object. Click Edit The Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, delete all contents in the Source text box, and then click Confirm The Source Attribute_Confirm button at the top right of the Details card to save your changes. The Source section of the Details card will now display the text None specified, indicating that no default Source Attribute has been added to the object.

Attributes Card

You can delete a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object. The Attribute will immediately be removed from the Attributes card.