The Description Attribute
  • 25 Oct 2022
  • 2 Minutes to read
  • Dark
    Light

The Description Attribute

  • Dark
    Light

Minimum Role: Organization role of Read Only User (for viewing Descriptions for Indicators, Groups, Tags, Tracks, Victims, and Victim Assets); Organization role of Standard User (for creating, editing, and deleting Descriptions for Indicators, Groups, Tags, Track, Victims, and Victim Assets)

Prerequisites: ThreatConnect object (IndicatorGroupTag, Track, Victim, or Victim Asset)

Overview

The Description Attribute, found on every Indicator, Group, Tag, Track, Victim, and Victim Asset in ThreatConnect®, is a space for the analyst to provide a brief, high-level explanation of the nature of the content. This information is useful for future reference and enables team members to quickly comprehend the meaning of the threat intelligence they are seeing.

Viewing, Creating, Editing, and Deleting Descriptions

Indicators, Groups, Victims, and Victim Assets

  1. Navigate to the Details screen for an Indicator, Group, Victim, or Victim Asset. For instructions on accessing an object’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.
  2. Scroll down to the Description card on the right side of the Details screen (Figure 1). The Description in Figure 1 is for an Indicator involving virtual private networks (VPNs). The goal of a good Description is to succinctly provide information on who, when, where, how, and why. When possible, answer these questions in the Description card, and reserve in-depth analysis for the Additional Analysis and Context Attribute.
    Graphical user interface  Description automatically generated

     

  3. If no Description is entered for an object, click Click here to add one. in the Description card to create one (Figure 2).
    Graphical user interface, application  Description automatically generated with medium confidence

     

  4. The Edit Attribute window will be displayed (Figure 3).
    Graphical user interface, application  Description automatically generated

     

    • Attribute Type: The Description Attribute type will be selected. Do not change this selection.
    • Default: Select this checkbox to set this Description as the default if there are other Descriptions for the object from other sources.
    • Choose Security Labels: Select any Security Labels to apply to the Description.
    • Attribute Source: Select an existing Attribute Source from the dropdown menu, or enter a new one.
    • Save Source: Select this checkbox to add the Source as an option in the Attribute Source dropdown menu in the future for objects belonging to the same owner.
    • Text Box: Enter the Description, either in plain text or in Markdown. See the “Using Markdown and ThreatConnect Markup in an Attribute” section of Creating Attributes for more information.
    • Click the SAVE button.
  5. The Attribute will be displayed in the Description card and the Attributes card (Figure 4).
    Graphical user interface, text, application, email  Description automatically generated

     

  6. To edit or delete a Description, click Editor DeleteIcon  Description automatically generated for the Description in the Attributes card, respectively.
    Note
    Changes made to the Description in the Attributes card are also applied to the Description in the Description card.

Tags and Tracks

  1. Navigate to the Details screen for a Tag or Track. For instructions on accessing an object’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.
  2. To create a new description, click Click here to enter a DescriptionIcon  Description automatically generatedin the Description card.
    Graphical user interface, application  Description automatically generated

     

  3. Enter a Description for the object in the text box, and click SaveIcon  Description automatically generatedto save it (Figure 6).
    Text  Description automatically generated with low confidence

     

  4. To edit an existing Description, click the Description in the Description card, make any desired changes to the Description, and click SaveIcon  Description automatically generatedto save the changes.
  5. To delete an existing Description, click the Description in the Description card, delete all contents in the text box, and click SaveIcon  Description automatically generatedto save the changes. The Description card will now display Click here to enter a DescriptionIcon  Description automatically generated.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20025-01 v.09.C


Was this article helpful?