The Description Attribute

Overview

The Description Attribute can be used to provide a brief, high-level explanation of the nature of a threat intelligence object. This information is useful for future reference and enables team members to quickly comprehend the meaning of the threat intelligence they are viewing.

When creating a Description Attribute for an Indicator, Group, or Victim in ThreatConnect^®, you can set the Attribute as the default Description Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Description Attribute is displayed on the Details card of the Overview tab; on the legacy Details screen, an object’s default Description Attribute is displayed on the Description and Attributes cards of the Overview tab. For Tags and Tracks, the concept of a default Description Attribute does not apply, as the Description for these objects is not captured in an Attribute.

Before You Start

Creating, Editing, and Deleting Descriptions

New Details Screen

On the new Details screen, you can view, create, and manage Description Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Event, Incident, Intrusion Set, Malware, Tactic, Threat, Tool, Vulnerability Groups. The new Details screen is not available for Document, Email, Report, Signature, and Task Groups; Victims; Tags; and Tracks.

Creating a Default Description

You can create the default Description Attribute for an object on the Details card or the Attributes card of an object’s new Details screen; however, you can view the default Description Attribute for an object only on the Details card. General (i.e., non-default) Description Attributes can be created and viewed on the Attributes card only.

Details Card

1. Navigate to the Details screen for an Indicator or Group.
2. On the Overview tab, click Editat the top right of the Details card, or click on the Description section of the Details card. The Description section will now be editable (Figure 1).

   

    

   • Description: Enter the Description Attribute’s value in plain text or Markdown. The goal of a good Description is to succinctly provide information on who, when, where, how, and why. When possible, use the Description Attribute to answer these questions, and reserve in-depth analysis for the Additional Analysis and Context Attribute.
     Note

     See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
     Note

     The Description text box supports the Marked library (https://marked.js.org/).
   • Preview Markdown: If you used Markdown when entering the Description Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
   • Click Confirmat the top right of the Details card.

The object’s default Description Attribute will be displayed in the Description section of the Details card (Figure 2). On the new Details screen, the default Description Attribute is displayed on the Details card only; it is not displayed on the Attributes card.

Attributes Card

You can create a Description Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object by selecting Description as the Attribute Type in the Add Attribute window. Select the Default Attribute checkbox if creating a default Description Attribute. Creating a default Description Attribute via this method will allow you to add an Attribute Source and Security Labels, although they will not be displayed on the Details card. Only the text entered in the Value field will be displayed on the Details card.

Editing a Description

Details Card

You can edit the default Description Attribute from the Details card on the new Details screen for an object. Click Editat the top right of the Details card, or click on the Description section of the Details card, make the desired changes to the default Description Attribute’s value, and then click Confirmat the top right of the Details card to save your changes.

Attributes Card

You can edit a general (non-default) Description Attribute from the Attributes card on the new Details screen for an object. Editing a general Description Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the Attributes card.

Deleting a Description

Details Card

You can delete the default Description Attribute from the Details card on the new Details screen for an object. Click Editat the top right of the Details card, or click on the Description section of the Details card, delete all contents in the Description text box, and then click Confirmat the top right of the Details card to save your changes. The Description section of the Details card will now display the text None specified, indicating that no default Description Attribute has been added to the object.

Attributes Card

You can delete a general (non-default) Description Attribute from the Attributes card on the new Details screen for an object. The Attribute will immediately be removed from the Attributes card.

Legacy Details Screen

On the legacy Details screen, you can view, create, and manage Description Attributes for all Indicator types, all Group types, and Victims. You can also manage Descriptions for Tags and Tracks.

Indicators, Groups, and Victims

Creating a Description

Description Card

1. Navigate to the legacy Details screen for an Indicator, Group, or Victim.
2. Scroll down to the Description card on the left side of the screen. If no default Description Attribute has been added to the object, a message stating “No Default Description entered.” will be displayed (Figure 3).

    

3. Click the Click here to add one. link in the Description card. The Edit Attribute window will be displayed.
4. Create the new default Description Attribute by keeping Description selected as the Attribute Type in the Edit Attribute window and leaving the Default checkbox selected.

After the default Description Attribute is created, it will be displayed in the Description card (Figure 4) and the Attributes card (Figure 5).

Attributes Card

You can create a Description Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object by selecting Description as the Attribute Type in the Edit Attribute window. Select the Default checkbox if creating a default Description Attribute.

Editing a Description

You can edit a Description Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. Any changes made to the default Description Attribute will be reflected in the Attributes and Description cards.

Deleting a Description

You can delete a Description Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. If you delete the default Description Attribute for an object, the Description card will display a message stating “No Default Description entered.” (Figure 3).

Tags and Tracks

Creating a Description

1. Navigate to the legacy Details screen for a Tag or Track.
2. Click the Click here to enter a Descriptiontext in the Description card (Figure 6).
   

    

3. Enter a Description for the object in the text box, and click Saveto save it (Figure 7).
   

    

Editing a Description

Click the Description in the Description card, make the desired changes in the text box, and click Saveto save the changes.

Deleting a Description

Click the Description in the Description card, delete all contents in the text box, and click Saveto save the changes. The Description card will now display Click here to enter a Description.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20025-01 v.11.A