Sourcing Data
  • 21 Oct 2022
  • 2 Minutes to read
  • Dark

Sourcing Data

  • Dark

Minimum Role: Organization role of Read Only User (for viewing Source Attributes); Organization role of Standard User (for creating, editing, and deleting Source Attributes)

Prerequisites: An IndicatorGroup, Victim, or Victim Asset


Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

Using and Administrating Source Attributes

  1. Navigate to the Details screen for an Indicator, Group, Victim, or Victim Asset (Host Indicator in this example).
  2. Scroll down to the Attributes card on the left side of the screen (Figure 1). Graphical user interface, text, application, email  Description automatically generated


  3. Click the Plus button at the upper-right corner of the Attributes card. The Edit Attribute window will be displayed (Figure 2). 


    • Select a Type: Select Source as the Attribute type.
    • Default: After selecting Source as the Attribute type, the Default checkbox will be displayed below the Select a Type dropdown menu. Objects can have multiple Source Attributes. If desired, select this checkbox to make this Attribute the default Source Attribute.
    • Choose Security Labels: Select any Security Labels to apply to the Source.
    • Attribute Source: Select an existing Attribute Source from the dropdown menu, or enter a new one.
    • Save Source: Select this checkbox to add the Source as an option in the Attribute Source dropdown menu so that it may be used again by the owner.
    • Text Box: Enter a description for the Source or its URL, either in plain text or Markdown.
      If there is no URL for the Source, such as when an Indicator is obtained from a listserv, this box can be left blank.
  4. The Source Attribute will be displayed in the Attributes card (Figure 3). Graphical user interface, text, application, email  Description automatically generated


  5. To edit or delete a Source Attribute, click Edit Icon  Description automatically generated or Delete Icon  Description automatically generated for the Source in the Attributes card, respectively.

Default Source Attribute

If you added the Source Attribute to an Indicator and selected the Default checkbox, it will also be displayed on the Indicator’s Description/Source card (Figure 4).

Graphical user interface, text, application, email  Description automatically generated


Only one Source Attribute can be designated as the default Source Attribute. If you select the Default checkbox for a second Source Attribute, that Source Attribute will replace the one originally designated as the default.

If no default Source has been added to an Indicator, click Click here to add one. in the Description/Source card to create one (Figure 5).

Graphical user interface, text, application, email  Description automatically generated


The Edit Attribute window (Figure 2) will be displayed with Source selected as the Attribute type and the Default checkbox selected. Fill out the remaining fields as outlined in Step 3 of the “Using and Administrating Source Attributes” section.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20017-01 v.08.C

Was this article helpful?