The Details Screen: Custom View

Overview

When working with Groups and Indicators in ThreatConnect^®, you can use the Custom View tab on the Details screen to display a customized view of the data that matter most to you, allowing you to make decisions more quickly during an investigation involving these object types. Each ThreatConnect user can configure two Custom View tabs for their user account: one for all Groups in all of their owners, and one for all Indicators in all of their owners.

As you configure the Custom View tab for Groups or Indicators, you can customize the tab’s layout, select which cards to show on the tab, and specify whether to display the tab by default each time you open the Details screen. After you configure a Custom View tab, you can export the tab’s configuration and share it with other users so that they can import it into their user account.

Before You Start

User Roles

• To access and manage the Custom View tab for Groups and Indicators, your user account can have any Organization role.
• To export and import Custom View tab configuration files, your user account can have any Organization role.

Prerequisites

• For the Tags Across Owners card to be available to add to the Indicator: Custom View tab, turn on the multiSourceViewEnabled system setting (must be a System Administrator to perform this action).

Accessing and Managing a Custom View Tab

Follow the steps in this section to access and configure the Group: Custom View and Indicator: Custom View tabs on the Details screen for Groups and Indicators, respectively.

1. Navigate to the Details screen for a Group or an Indicator.
2. Select the Custom View tab. If you are accessing this tab for the first time, it will display no cards.
3. Click Manage View on the Custom View tab to open the Manage View drawer (Figure 1). Then use the following options to configure the Custom View tab:
   

    

   • Set this custom tab as the default tab for all <object type> details: (Optional) Select this checkbox to display the Custom View tab instead of the Overview tab when you open the Details screen for the corresponding object type (Indicator in this example).
   • Layout: Select the layout of the Custom View tab.
   • + Add Cards: Click this button to add cards to the Custom View tab.
4. After you have made all desired changes to the Custom View tab, click Save on the Manage View drawer. The Custom View tab will now display all cards added to it in the selected layout (Figure 2).
   

    

   Note

   If you are viewing an Indicator that does not exist in your Organization and your user account has an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer, the Indicator’s Details screen will display a message stating the Indicator does not exist in your Organization and provide a link to create the Indicator in your Organization. If you click this link, the Details screen will show details for the copy of the Indicator in your Organization after it is created. In addition, if your System Administrator turned on the multiSourceViewEnabled system setting, your Organization will be listed on the Tags Across Owners card for the Indicator in addition to the Indicator’s other owners to which you have access.

Selecting a Custom View Tab Layout

When managing a Custom View tab, you can select one of the following tab layout options from the Layout dropdown on the Manage View drawer (Figure 1):

• 1 Column - 100: One-column layout that takes up 100% of the available width
• 2 Columns - 50/50 (default): Two-column layout where each column takes up 50% of the available width
• 2 Columns - 60/40: Two-column layout where the leftmost column takes up 60% of the available width and the rightmost column takes up the remaining 40%
• 2 Columns - 40/60: Two-column layout where the leftmost column takes up 40% of the available width and the rightmost column takes up the remaining 60%

Adding Cards to a Custom View Tab

A Custom View tab consists of one or more cards that display a variety of data that belong to the object whose Details screen you are viewing. When managing a Custom View tab, you can configure which cards to display on the tab and organize the layout of the cards via the Manage View drawer (Figure 1).

1. On the Manage View drawer, click + Add Cards to open the Add Cards window (Figure 3). This window shows all cards not added to the Custom View tab for the object type (Indicator in this example). In addition, the Applicable Types column shows the object types for which each card is available.
   Note

   If you added all available cards to a Custom View tab, the + Add Cards button will be grayed out.
   

    

   • Select one or more cards to add to the Custom View tab. As you select cards, the Selected button at the top left of the window will update to reflect the current number of selected items. When at least one card is selected, you can click the Selected or Clear Selectionbutton to view only the selected items or clear all selections, respectively.
     Note

     To select all available cards, select the checkbox in the table header.
   • Click the Add Cards button.
2. The Manage View drawer will display the cards selected on the Add Cards window (Figure 4). Here, you can organize the order of the cards on the Custom View tab by clicking and dragging cards to the desired position. If you selected a two-column layout for the Custom View tab, you can also click and drag cards to the desired column. To remove a card from the layout, click Deleteon the card.
   

    

Important

By default, association-based cards added to a Custom View tab using a two-column layout will display a subset of their table columns. While on the Custom View tab, click Select columnson an association-based card to manage which table columns the card will display.

Available Cards for Indicators

See Table 1 for a list of cards you can add to the Indicator: Custom View tab on the Details screen for Indicators.

¹ The Tags Across Owners card, which is a beta feature as of ThreatConnect 7.6, will be available to add to the Indicator: Custom View tab only if your System Administrator turned on the multiSourceViewEnabled system setting.

Available Cards for Groups

See Table 2 for a list of cards you can add to the Group: Custom View tab on the Details screen for Groups.

Exporting and Importing Custom View Tabs

After you configure a Custom View tab, you can export the tab’s configuration to a .tccv file. Other ThreatConnect users can then use the .tccv file to import the Custom View tab’s configuration into their user account.

Exporting a Custom View Tab

Follow these steps to export a Custom View tab’s configuration:

1. Navigate to the Details screen for a Group or an Indicator.
2. Select the Custom View tab. Then click Manage View to open the Manage View drawer.
3. Click the ⋯ menu at the top right of the Manage View drawer and select Export View to export the Custom View tab’s configuration to a .tccv file.
   
   Warning

   Do not modify the contents of a .tccv file. Otherwise, users may encounter errors when trying to import the file into ThreatConnect.

Importing a Custom View Tab

Follow these steps to import a Custom View tab’s configuration with a .tccv file:

1. Navigate to the Details screen for a Group or an Indicator.
2. Select the Custom View tab. Then click Manage View to open the Manage View drawer.
3. Click the ⋯ menu at the top right of the Manage View drawer and select Import View. Then locate and select a .tccv file to import. After the file is imported, the Manage View drawer will display the Custom View tab’s configuration, including its layout and cards.
4. Click Save on the Manage View drawer to save the imported Custom View tab’s configuration to your user account.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
DomainTools^® and Farsight Security® are registered trademarks of DomainTools, LLC.
VirusTotal™ is a trademark of Google, Inc.
RiskIQ^® is a registered trademark of Microsoft Corporation.
Shodan^® is a registered trademark of Shodan.

20162-01 v.02.A