---
title: "The Associations Tab | ThreatConnect"
slug: "the-associations-tab"
description: "This article describes the Associations tab of the Details screen and the actions you can perform on this screen."
tags: ["Connecting Data"]
updated: 2024-10-04T12:23:22Z
published: 2024-10-04T12:23:22Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Associations Tab

The **Associations**tab of an object’s **Details**screen provides options for filtering associated objects, adding associations, and removing associations. Depending on which **Details**screen version you are viewing, this tab will feature additional functionality. The **Associations**tab on the [new **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) allows you to view and manage potential associations for an object and create associations automatically using queries written in [ThreatConnect Query Language (TQL)](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql), and the **Associations**tab on the [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy) allows you to export associated Indicators.

## New Details Screen View

Figure 1 shows the **Associations** tab of the [new **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen)****for the **APT28**Intrusion Set Group. This tab displays separate cards containing Intelligence Requirements (IRs), Groups, Indicators, Victim Assets, Artifacts, and Cases associated to the object whose **Details**screen you are viewing (i.e., the primary object), with the total number of associated objects displayed to the right of the tab’s name. It also displays cards containing Cases and, for Groups only, Artifacts suggested as associations that you may want to add to the primary object. If viewing a Group’s **Details**screen, a card containing TQL queries added to the Group for TQL associations will also be displayed.

ImportantIf cross-owner associations are not enabled on your ThreatConnect instance, the **Artifact Associations**, **Case Associations**, and **Potential Associations** cards will not be displayed for Indicators and Groups in Communities and Sources.

![Figure 1_The Associations Tab_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20Associations%20Tab_7.7.0.png)

You can collapse and expand all cards on the **Associations**tab by clicking the **Collapse All**or **Expand All**button, respectively. By default, all cards are expanded.

Each card displays its contents in a paginated table. To control which table columns are displayed on the table, click the **Select columns![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Select%20columns%20button.png)**button at the top right of the card. To filter objects displayed in a table, use the search bar and **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)**menu at the top left of the card.

NoteYou cannot hide columns that are grayed out in the menu displayed when you click the **Select columns![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Select%20columns%20button.png)**button.

### TQL Queries

The **TQL Queries**card, available for IRs and Groups only, displays all [TQL](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql) queries used to create associations for an IR or a Group. Queries added to an IR or a Group will run automatically based on a schedule configured by your System Administrator (the default schedule is every night at midnight), but you may also run a query manually from the **TQL Queries**card.

Each time a query added to an IR or a Group runs, the query creates associations to results (i.e., objects returned by the query) that are not already associated to the IR or Group. If cross-owner associations are enabled on your ThreatConnect instance, the query will create associations to results that exist in any of your owners; otherwise, the query will create associations only to results that exist in the same owner as the IR or Group. You may view Groups and Indicators associated to an IR or a Group via a TQL query on the **Group Associations**and **Indicator Associations**cards, respectively, of the **Associations**tab.

The table displayed on the **TQL Queries**card contains the following columns:

- **Name**: This column displays the query’s name. To view the query itself, click the arrow to the left of its name. To view the results of the query on the **[](https://knowledge.threatconnect.com/docs/the-browse-screen)**[](https://knowledge.threatconnect.com/docs/the-browse-screen)[**Browse** screen](https://knowledge.threatconnect.com/docs/the-browse-screen)[](https://knowledge.threatconnect.com/docs/the-browse-screen)**[](https://knowledge.threatconnect.com/docs/the-browse-screen)** in a new browser tab, click **View query in browse![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**.
- **Type**: This column displays the query’s type, which corresponds to the type of objects the query will associate to the IR or Group. At this time, you can add only one Group query and one Indicator query to a single IR or Group object.
- **Status**: This column displays the query’s status (**Enabled**or **Disabled**). If the query has a **Disabled**status,![The Associations Tab_Disabled query_Warning icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Disabled%20query_Warning%20icon.png)and![The Associations Tab_Disabled query_Information icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Disabled%20query_Information%20icon.png)icons will be displayed to the left and right, respectively, of the status. To view a tooltip explaining why the query was disabled, hover over one of these icons.

NoteYou can use the **associatedGroupSource** and **associatedIndicatorSource** TQL parameters to filter Groups and Indicators based on the method (e.g., manual, API, TQL, etc.) used to create a Group or Indicator association, respectively. For more information on these parameters, see *[TQL Operators and Parameters](https://knowledge.threatconnect.com/docs/tql-operators-and-parameters)*.

#### Adding a TQL Query

Click the **Add Query![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **TQL Queries**card and then select **Group Query**or **Indicator Query**to add a Group or Indicator query, respectively, to an IR or a Group. Based on the type of query selected, the **Add Group TQL Query**(Figure 2) or **Add Indicator TQL Query**window will be displayed with the **Existing Queries**option selected, showing all [saved TQL queries](https://knowledge.threatconnect.com/docs/running-advanced-searches-with-tql#saving-tql-queries).

NoteIf a Group or Indicator query has been added to an IR or a Group, the **Group Query**or **Indicator Query**option, respectively, will be grayed out. Similarly, if the maximum number of queries that can be added to an IR or a Group has been reached, the **Add Query![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button will be grayed out.

![Figure 2_The Associations Tab_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_The%20Associations%20Tab_7.4.0.png)

- Select the query to add to the IR or Group. To view the query itself, click the arrow to the left of its name. To view the results of the query on the **Browse**screen in a new browser tab, click **View query in browse![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**.
- Click the **Add Query**button. The selected query will be displayed on the **TQL Queries**card.

ImportantIf you try to add a query to an IR or a Group when the maximum number of assigned TQL queries on your ThreatConnect instance has been reached, an error message will be displayed at the lower-left corner of the **Add Group TQL Query**or **Add Indicator TQL Query**window.

To create a new Group or Indicator query, select **New Query**at the top left of the **Add Group TQL Query**or **Add Indicator TQL Query**window, respectively. The window will now display options for creating a new query (Figure 3).

![Figure 3_The Associations Tab_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_The%20Associations%20Tab_7.4.0.png)

- **Query Name**: Enter a name for the query.
- **TQL Type**: The type of object (Group or Indicator) that the query will associate to the IR or Group. The query’s type is based on the option you selected after clicking the **Add Query![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button and cannot be changed.
- **Query**: Enter the query written in TQL. To view a list of [TQL operators and parameters](https://knowledge.threatconnect.com/docs/tql-operators-and-parameters) in a new browser tab, click the **View Full List of Query Commands![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**link above the **Query**text box.ImportantIf you try to create a new query and that query already exists (i.e., it is a saved query), an error message will be displayed at the lower-left corner of the **Add Group TQL Query**or **Add Indicator TQL Query**window directing you to use the existing query.
- Click the **Add Query**button. The newly created query will be displayed on the **TQL Queries**card and saved to your saved queries list.

NoteThe query you enter will not be validated on the **Add Group TQL Query**or **Add Indicator TQL Query**window. After adding a query to an IR or a Group, it is recommended to click **View query in browse![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**to the right of the query’s name on the **TQL Queries**card and verify that the query functions properly.

#### Running a TQL Query Manually

Click **Run Query![The Associations Tab_Run Query icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Run%20Query%20icon.png)**in the rightmost column for a query to run it manually. Messages indicating the status of the query’s execution will be displayed at the lower-left corner of the screen.

NoteIf a query has a **Disabled**status, then the **Run Query![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Run%20Query%20icon.png)**button for that query will be grayed out.

#### Removing a TQL Query

Click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for a query to remove it from an IR or a Group. A message confirming the query removal will be displayed at the lower-left corner of the screen. If you removed a query from an IR or a Group by accident, click **UNDO**in this message to re-add the query to the IR or Group.

NoteRemoving a query from an IR or a Group *will not* remove associations created when the query ran previously.

### Intelligence Requirement Associations

The **Intelligence Requirement Associations**card displays all [IRs](https://knowledge.threatconnect.com/docs/intelligence-requirements) associated to the primary object in a paginated table, with the total number of associated IRs displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **ID**: This column displays the IR’s ID.
- **Requirement**: This column displays the IR’s summary (i.e., the question, topic, or statement on which the IR focuses). To open the IR’s **Details**screen in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Subtype**: This column displays the IR’s subtype.
- **Category**: This column displays the IR’s category.
- **Owner**: This column displays the owner to which the IR belongs.
- **Tags**: If one or more Tags are applied to the IR, this column will display a count of those Tags; otherwise, no value will be displayed in this column. Click on the number displayed in this column to view the standard Tags and [ATT&CK® Tags](https://knowledge.threatconnect.com/docs/attack-tags) applied to the IR, as well as links to each Tag’s **Details**screen.
- **Date Added**: This column displays the date when the IR was created.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Intelligence Requirement Associations**card to create associations to one or more IRs. The **Add Intelligence Requirements**window will be displayed (Figure 4), showing all IRs that are not already associated to the primary object.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_The%20Associations%20Tab_7.4.0.png)

- Select one or more IRs to associate to the primary object. As you select IRs, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one IR is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter IRs by owner, subtype, category, creation date, and [last modified date](https://knowledge.threatconnect.com/docs/the-last-modified-date), use the **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)**menu; to filter IRs by their requirement text or ID, use the search bar.
- Click the **Add Intelligence Requirements** button to create associations to the selected IRs.

#### Removing an Association

Click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for an IR to dissociate it from the primary object.

### Group Associations

The **Group Associations**card displays all Groups associated to the primary object in a paginated table, with the total number of associated Groups displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **Type**: This column displays the Group’s [type](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#group-types).
- **Name/Summary**: This column displays the Group’s summary. To open the Group’s **Details**screen in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Owner**: This column displays the owner to which the Group belongs.
- **Tags**: If one or more Tags are applied to the Group, this column will display a count of those Tags; otherwise, no value will be displayed in this column. Click on the number displayed in this column to view the standard Tags and [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags) applied to the Group, as well as links to each Tag’s **Details**screen.
- **Last Modified**: This column displays the date when the Group was [last modified](https://knowledge.threatconnect.com/docs/the-last-modified-date).
- **Date Added**: This column displays the date when the Group was created.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Group Associations** card to create associations to one or more Groups. The **Add Groups**window will be displayed (Figure 5), showing all Groups that are not already associated to the primary object.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_The%20Associations%20Tab_7.4.0.png)

- Select one or more Groups to associate to the primary object. As you select Groups, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Group is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Groups by type, creation date, [last modified date](https://knowledge.threatconnect.com/docs/the-last-modified-date), and, if cross-owner associations are enabled, owner, use the **Filters**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)menu; to filter Groups by summary, use the search bar.
- Click the **Add Groups** button to create associations to the selected Groups.

#### Removing an Association

Click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for a Group to dissociate it from the primary object.

#### Viewing CAL Alias Information

If you are viewing the **Details**screen for a Group and known alias information for the Group exists in [CAL](https://knowledge.threatconnect.com/docs/threatassess-and-cal)™, a **CAL Aliases**button will be displayed at the upper-right corner of the **Group Associations**card, as in Figure 1. Click this****button to display the **Groups Via CAL Aliases**window, which shows one or more Groups in your ThreatConnect owners that CAL recommends associating to the Group being viewed (Figure 6). These Groups are recommended as associations because each has a summary that matches a known alias of the Group you are viewing.

ImportantIf CAL is not enabled on your ThreatConnect instance or for your Organization, the **CAL Aliases** button will not be displayed for Groups for which known alias information exists in CAL.NoteIf there are no unassociated Groups with a summary that matches a known alias of the Group being viewed, a message stating so will be displayed in the **Groups Via CAL Aliases** window, and no Groups will be displayed in this window.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_The%20Associations%20Tab_7.4.0.png)

- Select one or more Groups to associate to the Group being viewed. As you select Groups, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Group is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Groups by type, creation date, [last modified date](https://knowledge.threatconnect.com/docs/the-last-modified-date), and, if cross-owner associations are enabled, owner, use the **Filters**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)menu; to filter Groups by summary, use the search bar.
- Click the **Add Groups** button to create associations to the selected Groups.

### Indicator Associations

The **Indicator Associations**card displays all Indicators associated to the primary object in a paginated table, with the total number of associated Indicators displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **Type**: This column displays the Indicator’s [type](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicator-types).
- **Name/Summary**: This column displays the Indicator’s summary. To open the Indicator’s **Details**screen in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Threat Rating**: This column displays the Indicator’s [Threat Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings), if one has been set for the Indicator.
- **Owner**: This column displays the owner to which the Indicator belongs.
- **Tags**: If one or more Tags are applied to the Indicator, this column will display a count of those Tags; otherwise, no value will be displayed in this column. Click on the number displayed in this column to view the standard Tags and [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags) applied to the Indicator, as well as links to each Tag’s **Details**screen.
- **Last Modified**: This column displays the date when the Indicator was [last modified](https://knowledge.threatconnect.com/docs/the-last-modified-date).
- **Date Added**: This column displays the date when the Indicator was created.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Indicator Associations**card to create associations to one or more Indicators. The **Add Indicators**window will be displayed. If the primary object is an Indicator, the **Add Indicators**window will look like Figure 7.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_The%20Associations%20Tab_7.4.0.png)

- **Select an Association Type**: Select a custom Indicator-to-Indicator association type. Indicators of the target type that are not associated to the primary object will be displayed.
- Select one or more Indicators to associate to the primary object. As you select Indicators, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Indicator is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Indicators by creation date, [last modified date](https://knowledge.threatconnect.com/docs/the-last-modified-date), and, if cross-owner associations are enabled, owner, use the **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)**menu; to filter Indicators by summary, use the search bar.
- Click the **Add Indicators**button to create associations to selected Indicators.

If the primary object is a Group, the **Add Indicators** window will look like Figure 8. By default, the **Add Indicators**window will be displayed with the **Existing Indicators** option****selected, showing all existing Indicators not associated to the Group. To create an association to an Indicator that exists in one of your ThreatConnect owners, keep the selection of **Existing Indicators**at the top left of the **Add Indicators**window.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_The%20Associations%20Tab_7.4.0.png)

- Select one or more Indicators to associate to the selected Group. As you select Indicators, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Indicator is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Indicators by type, creation date, [last modified date](https://knowledge.threatconnect.com/docs/the-last-modified-date), and, if cross-owner associations are enabled, owner, use the **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)**menu; to filter Indicators by summary, use the search bar.
- Click the **Add Indicators**button to create associations to selected Indicators.

To create an association to an Indicator that does not exist in one of your ThreatConnect owners, select **New Indicators** at the top left of the **Add Indicators** window. The window will now display options for creating new Indicators (Figure 9).

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%209_The%20Associations%20Tab_7.4.0.png)

- **Indicator Type**: Select an Indicator type (available choices include **Unknown - (parsed)**, **File**, **Email Subject**, **Hashtag**, **Mutex**, **Registry Key**, and **User Agent**). The **Indicator Type** section will display options for entering Indicators of the selected type. If you selected **Unknown - (parsed)**, options to upload a file or enter text to be parsed for Indicators will be displayed, as in Figure 9. After entering the Indicator values or content to be parsed for Indicators, click the **+ Add**button.Note

Parsable Indicator types include Address, Email Address, File, Host, URL, ASN, and CIDR. Custom Indicator types may also be parsed if the following conditions are met:

  - a System Administrator selected the **Parsable**checkbox when configuring the custom Indicator type;
  - the custom Indicator type accepts a single value;
  - a System Administrator created an import rule for the custom Indicator type.

For more information on custom Indicator types and Indicator import rules, see the “Custom Indicator Types” and “Indicator Import Rules” sections, respectively, of *ThreatConnect System Administration Guide*.

ImportantIndicators included on an [Indicator Exclusion List](https://knowledge.threatconnect.com/docs/creating-indicator-exclusion-lists) will not be imported or associated to the Group.
- **New Indicators to be Associated**: This section displays the Indicator(s) that will be created and associated to the Group in a table with the following columns:
  - **Type**: This column displays the Indicator’s type.
  - **Summary**: This column displays the Indicator’s summary.
  - **Known**: This column indicates whether the Indicator exists in the Group's owner.
  - **Private**: This column will be displayed only if your System Administrator has enabled private Indicators. To mark an Indicator as [private](https://knowledge.threatconnect.com/v1/docs/private-indicators), select the corresponding checkbox in the **Private** column.
  - **Actions**: To remove an Indicator from the table, click **Delete![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Delete%20icon.png)**in this column.
- **Additional Details**: In this****section, you can fill out the following information for *all*Indicators being created and associated to the Group:
  - **Owner**: This *required*field is displayed only if cross-owner associations are enabled on your ThreatConnect instance. Select the owner in which the Indicator(s) will be created. If cross-owner associations are not enabled on your ThreatConnect instance, the Indicator(s) will be created in the owner to which the primary Group object belongs.
  - **Description**: Enter a [Description](https://knowledge.threatconnect.com/docs/the-description-attribute) for the Indicator(s).
  - **Tags**: Enter [Tags](https://knowledge.threatconnect.com/docs/applying-tags) to apply to the Indicator(s).
  - **Confidence Rating**: Use the slider to set the [Confidence Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s).
  - **Threat Rating**: Use the skull icons to set the [Threat Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) for the Indicator(s).
- Click the **Add Indicators** button to create the new Indicators and associate them to the Group.

#### Removing an Association

If the primary object is a Group, click **Remove<meta charset="utf-8">![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for the Indicator to dissociate it from the Group.

If the primary object is an Indicator, click the **⋯**menu in the rightmost column and select**Association Details**. The **Association Details**window will be displayed, showing how the Indicator is associated to the primary Indicator (e.g., directly associated via an Indicator-to-Indicator association, indirectly associated via a shared Group association). Click the **Remove Association**button on the **Association Details**window to dissociate the Indicator from the primary Indicator.

### Victim Asset Associations

The **Victim Asset Associations**card displays all Victim Assets associated to the primary object in a paginated table, with the total number of associated Victim Assets displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **Type**: This column displays the Victim Asset’s type.
- **Name/Summary**: This column displays the Victim Asset’s summary. To open the  **Details**screen for the Victim to which the Victim Asset belongs in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Victim**: This column displays the Victim to which the Victim Asset belongs.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Victim Asset Associations** card to create associations to one or more Victim Assets. The **Add Victim Assets**window will be displayed (Figure 10), showing all Victim Assets that are not already associated to the primary Group object.

ImportantThe **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button is displayed only for Groups, as you cannot create direct associations between Victim Assets and Indicators. Also, cross-owner associations are not supported for Victim Assets at this time.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2010_The%20Associations%20Tab_7.4.0.png)

- Select one or more Victim Assets to associate to the Group. As you select Victim Assets, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Victim Asset is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Victim Assets by type, use the **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Filters%20button.png)**menu; to filter Victim Assets by summary, use the search bar.
- Click the **Add Victim Assets** button to create associations to the selected Victim Assets.

#### Removing an Association

If the primary object is an Indicator, click the **⋯**menu in the rightmost column and select**Association Details**. The **Association Details**window will be displayed, showing how the Victim Asset is associated to the primary Indicator (i.e., indirectly associated via a shared Group association). Click the **Remove Association**button on the **Association Details**window to dissociate the Victim Asset from the primary Indicator.

If the primary object is a Group, the only way you can dissociate the Victim Asset from the Group is by navigating to the **Details**screen for the Victim to which the Victim Asset belongs and removing the association from the **[](https://knowledge.threatconnect.com/docs/table-view-associated-groups)** [](https://knowledge.threatconnect.com/docs/table-view-associated-groups)[**Associated Groups** section of the **Associations** card](https://knowledge.threatconnect.com/docs/table-view-associated-groups)[](https://knowledge.threatconnect.com/docs/table-view-associated-groups)**[](https://knowledge.threatconnect.com/docs/table-view-associated-groups)**.

### Artifact Associations

The **Artifact Associations**card displays all [Artifacts](https://knowledge.threatconnect.com/docs/artifacts) associated to the primary object in a paginated table, with the total number of associated Artifacts displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **Type**: This column displays the Artifact’s type.
- **Name**: This column displays the Artifact’s summary.
- **Case**: This column displays the [Workflow Case](https://knowledge.threatconnect.com/docs/workflow-cases) to which the Artifact belongs. To open the Case in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Analytics Score**: This column displays the Artifact’s [ThreatAssess assessment level and score](https://knowledge.threatconnect.com/docs/threatassess-and-cal).
- **Status**: For Artifacts that are ThreatConnect Indicator types, this column displays CAL’s assessment of whether the Indicator is an active Indicator of Compromise (IOC) at the current time. If an Artifact is not a ThreatConnect Indicator, or if CAL did not return data identifying whether the Indicator is active or inactive at the current time, then no value will be displayed in this column for the Artifact.
- **Date Added**: This column displays the date when the Artifact was created.

NoteIf cross-owner associations are not enabled on your ThreatConnect instance, the **Artifact Associations**card will not be displayed for Indicators and Groups in Communities and Sources.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Artifact Associations**card to create associations to one or more Artifacts. The **Link Artifacts**drawer will be displayed (Figure 11), showing all Artifacts in all of the Workflow Cases in your Organization that are not already associated to the primary object.

NoteThe **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button is displayed for Indicators and Groups in an Organization only. To associate Artifacts to Indicators and Groups in Communities and Sources, navigate to the Case containing the Artifact, expand the Artifact to view its details, and create the association from the **[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-indicators)**[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-indicators)[**Associated Indicators**](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-indicators)[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-indicators)**[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-indicators)**or **[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-groups)**[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-groups)[**Associated Groups**](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-groups)[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-groups)**[](https://knowledge.threatconnect.com/docs/viewing-artifact-details#associated-groups)** section, respectively.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2011_The%20Associations%20Tab_7.4.0.png)

- Select one or more Artifacts to associate to the primary object. To filter Artifacts by type, use the **FILTERS**selector; to filter Artifacts by summary, use the search bar.
- Click the **ADD SELECTED** button to create associations to the selected Artifacts.

You can also create associations between Indicators or Groups and Artifacts within a Workflow Case via the Case’s [**Artifacts**card](https://knowledge.threatconnect.com/docs/artifacts-card). See the [“Associated Indicators”](https://knowledge.threatconnect.com/v1/docs/viewing-artifact-details#associated-indicators) and [“Associated Groups”](https://knowledge.threatconnect.com/v1/docs/viewing-artifact-details#associated-groups) sections of [*Viewing Artifact Details*](https://knowledge.threatconnect.com/v1/docs/viewing-artifact-details) for more information.

#### Removing an Association

Click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for an Artifact to dissociate it from the primary object.

### Case Associations

The **Case Associations**card displays all [Workflow Cases](https://knowledge.threatconnect.com/docs/workflow-cases) associated to the primary object in a paginated table, with the total number of associated Cases displayed to the right of the card’s header. The table displayed on this card contains the following columns:

- **ID**: This column displays the Case’s ID number.
- **Name**: This column displays the Case’s name. To open the Case in the current browser tab or a new one, click its summary or **View details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_View%20details%20in%20new%20tab%20icon.png)**, respectively.
- **Assignee**: This column displays the user or user group to which the Case is [assigned](https://knowledge.threatconnect.com/docs/parts-of-a-case#assignee).
- **Resolution**: This column displays the Case’s [resolution](https://knowledge.threatconnect.com/docs/parts-of-a-case#resolution).
- **Status**: This column displays the Case’s [status](https://knowledge.threatconnect.com/docs/parts-of-a-case#status).
- **Severity**: This column displays the Case’s [severity](https://knowledge.threatconnect.com/docs/parts-of-a-case#severity).
- **Date Added**: This column displays the date when the Case was created.

NoteIf cross-owner associations are not enabled on your ThreatConnect instance, the **Case Associations**card will not be displayed for Indicators and Groups in Communities and Sources.

#### Creating an Association

Click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button at the upper-right corner of the **Case Associations**card, and then select one of the following options to create associations to one or more Cases:

- **Add Existing…**: Select this option to create associations to one or more existing Cases.
- **Add New…**: Select this option to create an association to a newly created Case.

Selecting **Add Existing…**in the **Add Association****![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**menu will open the **Add Cases**window (Figure 12), showing all Cases in your Organization that are not associated to the primary object.

NoteThe **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button is displayed for Indicators and Groups in an Organization only. To create an association between a Case and an Indicator or Group in a Community or Source, navigate to the Case’s **[](https://knowledge.threatconnect.com/docs/associations-card-for-cases)**[](https://knowledge.threatconnect.com/docs/associations-card-for-cases)[**Associations** card](https://knowledge.threatconnect.com/docs/associations-card-for-cases)[](https://knowledge.threatconnect.com/docs/associations-card-for-cases)**[](https://knowledge.threatconnect.com/docs/associations-card-for-cases)** and create the association from there.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2012_The%20Associations%20Tab_7.7.0.png)

- Select one or more Cases to associate to the primary object. As you select Cases, the **Selected**button at the top left of the window will update to reflect the current number of selected items. When at least one Case is selected, you can click the **Selected**or **Clear Selection**button to view only the selected items or clear all selections, respectively.
- To filter Cases by severity, resolution, status, assignee, and creation date, use the **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Filters%20button_Details%20screen.png)**menu; to filter Cases by name, use the search bar.
- Click the **Add Cases**button to create associations to the selected Cases.

Selecting **Add New…**in the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**menu will open the **New Case**drawer (Figure 13).

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2013_The%20Associations%20Tab_7.7.0.png)

- See [*Creating Cases*](https://knowledge.threatconnect.com/v1/docs/creating-cases)**for descriptions of each option on this drawer.
- Click the **SAVE** button to create the new Case and associate it to the primary object.

You can also create associations between Indicators or Groups and Workflow Cases via a Case’s **Associations**card. See the [“Indicators”](https://knowledge.threatconnect.com/v1/docs/associations-card-for-cases#indicators) and [“Groups”](https://knowledge.threatconnect.com/v1/docs/associations-card-for-cases#groups) sections of [*Associations Card for Cases*](https://knowledge.threatconnect.com/v1/docs/associations-card-for-cases) for more information.

#### Removing an Association

Click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Remove%20Association%20icon.png)**in the rightmost column for a Case to dissociate it from the primary object.

### Potential Associations

The **Potential Associations**card displays Cases and, for Groups only, Artifacts suggested as associations that you may want to add to the primary object.

NoteIf cross-owner associations are not enabled on your ThreatConnect instance, the **Potential Associations**card will not be displayed for Indicators and Groups in Communities and Sources.

#### Viewing Potentially Associated Artifacts

The **Artifacts**sub-card, available for Groups only, displays Artifacts that have their [**Use to potentially associate cases.**checkbox](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case) selected and meet one or both of the following conditions, depending on how your System Administrator configured potential associations for your ThreatConnect instance:

- The Artifact matches the summary and type of an Indicator associated to the Group (e.g., an Artifact whose type is Host and summary is **bad.com**will be suggested as an association for a Group associated to the **bad.com**Host Indicator). Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**.
- The Artifact is associated to an Indicator associated to the Group. Artifacts that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**.

When reviewing potential Artifact associations, you can click on the name of the Artifact’s Case to investigate both items further and decide whether to associate the Artifact to the Group.

#### Viewing Potentially Associated Cases

The **Cases** sub-card, available for Groups and Indicators, displays Cases that meet one or both of the following conditions, depending on the object’s type and how your System Administrator configured potential associations for your ThreatConnect instance:

- Groups
  - The Case contains an Artifact that has its [**Use to potentially associate cases.**checkbox](https://knowledge.threatconnect.com/docs/adding-artifacts-to-a-case) selected and matches the summary and type of an Indicator associated to the Group (e.g., a Case that contains an Artifact whose type is Host and summary is **bad.com** will be suggested as an association for a Group associated to the **bad.com**Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**.
  - The Case is associated to an Indicator associated to the Group. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**.
- Indicators
  - The Case contains an Artifact that has its **Use to potentially associate cases.**checkbox selected and matches the summary and type of the Indicator you are viewing (e.g., a Case that contains an Artifact whose type is Host and summary is **bad.com** will be suggested as an association for the **bad.com**Host Indicator). Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Matched**or **Both**.
  - The Case is associated to a Group associated to the Indicator. Cases that meet this condition will be suggested as associations only if your System Administrator set the potential associations system setting to **Associated**or **Both**.

#### Creating an Association

To associate an Artifact or Case suggested as a potential association to the primary object, click the **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button in the rightmost column for the Artifact or Case. After the Artifact or Case is added as an association, it will be removed from the **Potential Associations**card.

If at any point you dissociate an Artifact or Case that was suggested as a potential association from the primary object, it will be readded to the **Artifacts**or **Cases**sub-card, respectively.

NoteThe **Add Association![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/The%20Associations%20Tab_Add%20Association%20button.png)**button is displayed for Indicators and Groups in an Organization only. To associate a potentially associated Case to an Indicator or Group in a Community or Source, navigate to the Case’s [**Potential Associations**card](https://knowledge.threatconnect.com/docs/potential-associations-card-for-cases) and create the association from there. To associate a potentially associated Artifact to a Group in a Community or Source, navigate to the Case containing the Artifact, expand the Artifact to view its details, and [create the association from the **Associated Groups**section](https://knowledge.threatconnect.com/docs/viewing-artifact-details#adding-group-associations).

## Legacy Details Screen View

Figure 14 shows the **Associations** tab of the [legacy **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)****for the **superbadguy.com**Host Indicator. In addition to being able to filter associated objects and add and remove associations, you can export associated objects to a CSV file on the **Associations**tab of the legacy **Details**screen.

![Graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2014_The%20Associations%20Tab_7.4.0.png)

### Viewing and Filtering Associations

The associated objects provided in the table of the **Associations**tab are classified by type according to the icon menus in the center. Choosing an item from each menu (e.g., **Signatures** from the **Documents** menu) displays only associated objects of that type. Clicking on the menu itself (i.e., clicking on the icon without selecting an item from its menu) displays associated objects of all of the types listed in that menu, as in Figure 14, which lists all Indicators associated with the primary Indicator, including custom Indicator-to-Indicator associations, Indicators that are associated to the primary Indicator by a [DNS resolution](/v1/docs/dns-resolutions) or a [File action (File Archive, File Drop, or File Traffic)](/v1/docs/modeling-file-behavior), and Indicators that are associated to the primary Indicator via a shared Group.

The table columns depend on the type of primary object and which menu or menu item has been selected. For example, for a primary Indicator object, any **Indicators** table that is populated with at least one entry has a column with **Details**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/the-associations-tab-image-di8ky21l.png)icons that, when clicked, provide information about the Group object to which both Indicators (the primary Indicator and the associated Indicator) are associated and options to dissociate the primary Indicator from the Group (and therefore from all Indicators associated with the Group). For a primary Group object, the **Indicators** tables do not have this icon, but rather a **Dissociate** link that, when clicked, immediately (i.e., without a request for confirmation) dissociates the Group from the Indicator. As another example, the **Reports**and **Signatures**tables have **[](https://knowledge.threatconnect.com/docs/group-intel-rating)** [](https://knowledge.threatconnect.com/docs/group-intel-rating)[Intel Rating](https://knowledge.threatconnect.com/docs/group-intel-rating) [](https://knowledge.threatconnect.com/docs/group-intel-rating)**[](https://knowledge.threatconnect.com/docs/group-intel-rating)** (**Thumbs Up** and **Thumbs Down**) columns.

For a primary Indicator object, the **Indicators**tables will display a **Relation Type** menu at the top right of the table, as in Figure 14. This menu allows you to filter the Indicators shown by type of association (i.e., custom Indicator-to-Indicator association, DNS resolution, type of File action, or type of Group through which the Indicator-to-Group-to-Indicator first-level association exists).

### Adding an Association

1. Click the **+****NEW ASSOCIATION** button in Figure 14. The **Select an Association**window will be displayed (Figure 15).

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2015_The%20Associations%20Tab_7.7.0.png)
2. Use the **Select Type** dropdown menu to select the association type to create. Objects that qualify for this association type will be displayed in the table. For example, in Figure 16, **Adversary**was selected.

![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2016_The%20Associations%20Tab_7.7.0.png)
3. Select the Indicator(s) or Group(s) to associate to the primary object. If desired, use the **Filter**box to filter Indicators or Groups displayed in the table.ImportantWhen searching for file hashes, the **Filter** box performs a case-sensitive search. For example, a search for the file hash “0413F832D8161187172AEF7A769586515F969479” will not return “0413f832d8161187172aef7a769586515f969479” as a result.
4. Click the **SAVE**button.NoteYou can also add associations from both the [graph view](/docs/the-associations-card-graph-view) and [table view](/docs/the-associations-card-table-view) of the [**Associations** card](/docs/the-associations-card) on the **Overview** tab of the legacy **Details** screen.

### Exporting Associated Objects

Click on the **EXPORT**dropdown menu at the lower-left corner of the screen (Figure 14) and select the **ThreatConnect CSV** option. The **Export Data**window will be displayed (Figure 17).

![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2017_The%20Associations%20Tab_7.7.0.png)

- Clear the checkbox(es) for any field(s) that should not be included in the CSV file.
- Click the **EXPORT**button. The CSV file will download to your computer.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.*

20076-13 v.14.A