--- title: "Table View: Potential Associations | ThreatConnect" slug: "table-view-potential-associations" description: "This article describes the Potential Associations section of the Associations card on the Overview tab of the Details screen, which is displayed when viewing the Associations card in table view." updated: 2024-01-30T20:38:38Z published: 2024-01-30T20:38:38Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Table View: Potential Associations When viewing the [**Associations**card](/v1/docs/the-associations-card) in [table view](/v1/docs/table-view-overview), the **Potential Associations** section displays [Workflow Cases](/v1/docs/workflow-cases) and, for Groups only, [Artifacts](https://knowledge.threatconnect.com/v1/docs/artifacts) suggested as associations that you may want to add to the primary object (Figure 1). NoteIf cross-owner associations are not enabled on your ThreatConnect instance, the **Potential Associations** section will not be displayed for Indicators and Groups in Communities and Sources. ![Graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Table%20View_Potential%20Associations_Figure%201.png) ## Viewing Potentially Associated Artifacts The **Artifacts**table, available for Groups only, displays Artifacts that have their [**Use to potentially associate cases.**checkbox](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case) selected and meet one or both of the following conditions, depending on how your System Administrator configured potential associations for your ThreatConnect instance: - The Artifact matches the summary and type of an Indicator associated to the Group (e.g., an Artifact whose type is Host and summary is **bad.com**will be suggested as an association for a Group associated to the **bad.com**Host Indicator). Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**. - The Artifact is associated to an Indicator associated to the Group. Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**. When reviewing potential Artifact associations, you can click on the name of the Artifact’s Case to investigate both items further and decide whether to associate the Artifact to the Group. ## Viewing Potentially Associated Cases The **Cases** table, available for Groups and Indicators, displays Cases that meet one or both of the following conditions, depending on the object’s type and how your System Administrator configured potential associations for your ThreatConnect instance: - Groups - The Case contains an Artifact that has its [**Use to potentially associate cases.**checkbox](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case) selected and matches the summary and type of an Indicator associated to the Group (e.g., a Case that contains an Artifact whose type is Host and summary is **bad.com** will be suggested as an association for a Group associated to the **bad.com**Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**. - The Case is associated to an Indicator associated to the Group. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**. - Indicators - The Case contains an Artifact that has its **Use to potentially associate cases.** checkbox selected and matches the summary and type of the Indicator you are viewing (e.g., a Case that contains an Artifact whose type is Host and summary is **bad.com** will be suggested as an association for the **bad.com**Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**. - The Case is associated to a Group associated to the Indicator. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**. ## Creating an Association To associate an Artifact or Case suggested as a potential association to the primary object, select **Associate**from the vertical ellipsis for the desired Artifact or Case. After the Artifact or Case is associated to the primary object, it will be removed from the **Potential Associations**section. If at any point you dissociate an Artifact or Case that was suggested as a potential association from the primary object, it will be readded to the **Artifacts**or **Cases**table, respectively. NoteThe vertical ellipsis is displayed for Indicators and Groups in an Organization only. To associate a potentially associated Case to an Indicator or Group in a Community or Source, navigate to the Case’s [**Potential Associations** card](https://knowledge.threatconnect.com/docs/potential-associations-card-for-cases) and create the association from there. To associate a potentially associated Artifact to a Group in a Community or Source, navigate to the Case containing the Artifact, expand the Artifact to view its details, and [create the association from the **Associated Groups**section](https://knowledge.threatconnect.com/docs/viewing-artifact-details#adding-group-associations). --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20076-12 v.11.A