Table View: Potential Associations
  • 30 Jan 2024
  • 3 Minutes to read
  • Dark
    Light

Table View: Potential Associations

  • Dark
    Light

Article summary

When viewing the Associations card in table view, the Potential Associations section displays Workflow Cases and, for Groups only, Artifacts suggested as associations that you may want to add to the primary object (Figure 1).

Note
If cross-owner associations are not enabled on your ThreatConnect instance, the Potential Associations section will not be displayed for Indicators and Groups in Communities and Sources.

Graphical user interface  Description automatically generated

 

Viewing Potentially Associated Artifacts

The Artifacts table, available for Groups only, displays Artifacts that have their Use to potentially associate cases. checkbox selected and meet one or both of the following conditions, depending on how your System Administrator configured potential associations for your ThreatConnect instance:

  • The Artifact matches the summary and type of an Indicator associated to the Group (e.g., an Artifact whose type is Host and summary is bad.com will be suggested as an association for a Group associated to the bad.com Host Indicator). Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
  • The Artifact is associated to an Indicator associated to the Group. Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.

When reviewing potential Artifact associations, you can click on the name of the Artifact’s Case to investigate both items further and decide whether to associate the Artifact to the Group.

Viewing Potentially Associated Cases

The Cases table, available for Groups and Indicators, displays Cases that meet one or both of the following conditions, depending on the object’s type and how your System Administrator configured potential associations for your ThreatConnect instance:

  • Groups
    • The Case contains an Artifact that has its Use to potentially associate cases. checkbox selected and matches the summary and type of an Indicator associated to the Group (e.g., a Case that contains an Artifact whose type is Host and summary is bad.com will be suggested as an association for a Group associated to the bad.com Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
    • The Case is associated to an Indicator associated to the Group. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.
  • Indicators
    • The Case contains an Artifact that has its Use to potentially associate cases. checkbox selected and matches the summary and type of the Indicator you are viewing (e.g., a Case that contains an Artifact whose type is Host and summary is bad.com will be suggested as an association for the bad.com Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Matched or Both.
    • The Case is associated to a Group associated to the Indicator. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to Associated or Both.

Creating an Association

To associate an Artifact or Case suggested as a potential association to the primary object, select Associate from the vertical ellipsis for the desired Artifact or Case. After the Artifact or Case is associated to the primary object, it will be removed from the Potential Associations section.

If at any point you dissociate an Artifact or Case that was suggested as a potential association from the primary object, it will be readded to the Artifacts or Cases table, respectively.

Note
The vertical ellipsis is displayed for Indicators and Groups in an Organization only. To associate a potentially associated Case to an Indicator or Group in a Community or Source, navigate to the Case’s Potential Associations card and create the association from there. To associate a potentially associated Artifact to a Group in a Community or Source, navigate to the Case containing the Artifact, expand the Artifact to view its details, and create the association from the Associated Groups section.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20076-12 v.11.A


Was this article helpful?