The Details Screen (Legacy)

Overview

The Details screen is the main screen where you can view and manage information and metadata for the following ThreatConnect^® object types: Indicators, Groups, Tags, Tracks, and Victims. Although data displayed on the Details screen depends on the type of object you are viewing, some of the most commonly displayed information includes Attributes added to the object, Security Labels and Tags applied to the object, a list of objects associated to the object you are viewing, and insights from CAL™. This screen also provides shortcuts to various ThreatConnect features, such as reporting and Threat Graph.

Before You Start

Viewing the Legacy Details Screen

1. On the top navigation bar, hover the cursor over Browse and select an object category (i.e., Indicators, Groups, Tags, Tracks, Victims, or Victim Assets) or type (e.g., Host, Adversary) to display a results table containing objects of the selected category or type on the Browse screen.
2. Hover over an object’s entry in the table on the Browse screen and click one of the following icons displayed in its Summary cell to display the Overview tab of the new Details screen for the object:
   • View full details: Click this icon to open the object’s Details screen in the current browser tab.
   • View full details in new tab: Click this icon to open the object’s Details screen in a new browser tab.
3. Click the Revert to Legacy View button at the top right of the new Details screen to display the legacy Details screen for the object.

Alternatively, click on an object’s entry in the table on the Browse screen to display its Details drawer, click the View full detailsicon at the upper-right corner of the drawer to display the Overview tab of the new Details screen for the object, and then click the Revert to Legacy View button at the top right of the new Details screen to display the legacy Details screen for the object.

Note

For a Victim Asset, no icons are displayed when hovering over its entry in the table on the Browse screen. Instead, you must click on its entry in the table to display its Details drawer and then click the View full detailsicon at the upper-right corner of the drawer. This will display the new Details screen for the Victim to which the Victim Asset belongs.

New Details Screen View

The new Details screen view is currently available for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Document, Event, Incident, Intrusion Set, Malware, Report, Tactic, Threat, Tool, and Vulnerability. It is not available for Email, Signature, and Task Groups; Tags; Tracks; and Victims.

For more information on the new Details screen view, see The Details Screen.

Legacy Details Screen View

The legacy Details screen view is available for all Indicator types, Group types, Tags, Tracks, and Victims. It is the only Details screen view available for Email, Signature, and Task Groups; Tags; Tracks; and Victims. For all other object types, the new Details screen view is the default view.

Figure 1 shows the Overview tab of the legacy Details screen for a Host Indicator (badguy.com), and Figure 2 shows the Overview tab of the legacy Details screen for an Adversary Group (Bad Guy).

Legacy Details Screen Header

Indicators

The legacy Details screen for Indicators (Figure 1) includes the following sections and elements in its header:

• Object icon and name: This section displays the Indicator’s name and an icon denoting that it is an Indicator. This icon is the same for all Indicator types.
• Owner: The orange rectangle at the upper-right corner of the screen displays the owner to which the Indicator belongs. If the Indicator belongs to multiple owners, a selector will be displayed to the right of the orange rectangle that allows you to view copies of the Indicator in each owner to which it belongs and to which you have access.
• Try New Details View: Click the Try New Details View button to display the Overview tab of the new Details screen for the Indicator in the current browser tab.
• Explore In Graph: Click the Explore In Graph button to view the Indicator in Threat Graph.
• Pivot: Click the Pivot button to pivot to a list of all associated intelligence for the Indicator.
• Delete: Click the Delete button to delete the Indicator. This button will not be displayed if you do not have permissions to delete data in ThreatConnect.
• Navigation Tab Menu: The Navigation Tab Menu contains a series of tabs relevant to the particular Indicator type. See the “Object-Specific Tabs” section for descriptions of all object-specific tabs on the legacy Details screen.
• Follow Item: Select the Follow Item checkbox on the right side of the Navigation TabMenu to receive alerts and updates on changes to the Indicator. After selecting this checkbox, select the desired notification priority level (Low, Medium, or High).
• Active: Select the checkbox to set the Indicator Status to active, or clear the checkbox to set the Indicator Status to inactive.
• Add to Exclusion List: Select this checkbox to add the Indicator to the Indicator Exclusion List corresponding to its Indicator type.
  Important

  The Add to Exclusion List option will be displayed for Organization and System Administrators only on ThreatConnect instances where this functionality is enabled in the system settings. If you add an Indicator to an Exclusion List using this method, the only way to remove it from the Exclusion List is via the Organization Config screen, as detailed in the “Adding an Indicator to an Exclusion List from the Details Screen” section of Creating Indicator Exclusion Lists.
• CAL Status Lock: Select the checkbox to prevent CAL from changing the Indicator Status.

Groups

• Object icon and name: This section displays the Group’s name and an icon corresponding to its Group type. In addition, an Editicon is displayed to the right of the Group’s name that, when clicked, allows you to edit the name. This icon will not be displayed if you do not have permissions to edit data in ThreatConnect.
• Owner: The orange rectangle at the upper-right corner of the screen displays the owner to which the Group belongs.
• Try New Details View: The Try New Details View button will be displayed for all Group types except Email, Signature, and Task Groups. Click this button to display the Overview tab of the new Details screen for the Group in the current browser tab.
• Explore In Graph: Click the Explore In Graph button to view the Group in Threat Graph.
• Create Report: Click the Create Report button to create a report for the Group and open the Report Editor in a new browser tab.
• Pivot: Click the Pivot button to pivot to a list of all associated intelligence for the Group.
• Delete: Click the Delete button to delete the Group. This button will not be displayed if you do not have permissions to delete data in ThreatConnect.
• Copy To My Org: The Copy To My Org button will be displayed only for Groups that belong to a Community. Click this button to copy the Group from the Community to your Organization.
• Download PDF: The Download PDF button will be displayed for all Group types except Document, Email, Signature, and Task Groups. Click this button to generate a PDF document of the Group.
• Upvoteand Downvote: This section is where you can view the number of Upvote and Downvote Intel Ratings the Group has received and update the Group's Intel Rating.
• Navigation Tab Menu: The Navigation Tab Menu contains a series of tabs relevant to the particular Group type. See the “Object-Specific Tabs” section for descriptions of all object-specific tabs on the legacy Details screen.
• Follow Item: Select the Follow Item checkbox on the right side of the Navigation TabMenu to receive alerts and updates on changes to the Group. After selecting this checkbox, select the desired notification priority level (Low, Medium, or High).

Tags

The legacy Details screen for Tags includes the following sections and elements in its header:

• Object icon and name: This section displays the Tag's name and an icon denoting that it is a Tag. In addition, an Editicon is displayed to the right of the Tag’s name that, when clicked, allows you to edit the name. This icon will not be displayed if you do not have permissions to edit data in ThreatConnect.
• Owner: The orange rectangle at the upper-right corner of the screen displays the owner to which the Tag belongs.
• Explore In Graph: Click the Explore In Graph button to view the Tag in Threat Graph.
• Delete: Click the Delete button to delete the Tag. This button will not be displayed if you do not have permissions to delete data in ThreatConnect.
• Navigation Tab Menu: The Navigation Tab Menu contains a series of tabs relevant to Tags. See the “Object-Specific Tabs” section for descriptions of all object-specific tabs on the legacy Details screen.
• Follow Item: Select the Follow Item checkbox on the right side of the Navigation TabMenu to receive alerts and updates on changes to the Tag. After selecting this checkbox, select the desired notification priority level (Low, Medium, or High).

Tracks and Victims

The legacy Details screen for Tracks and Victims includes the following sections and elements in its header:

• Object icon and name: This section displays the object's name and an icon corresponding to its type. For Victims, an Editicon is displayed to the right of the Victim's name that, when clicked, allows you to edit the name. This icon will not be displayed if you do not have permissions to edit data in ThreatConnect.
• Owner: The orange rectangle at the upper-right corner of the screen displays the owner to which the object belongs.
• Delete: Click the Delete button to delete the object. This button will not be displayed if you do not have permissions to delete data in ThreatConnect.
• Navigation Tab Menu: The Navigation Tab Menu contains a series of tabs relevant to the particular object type. See the “Object-Specific Tabs” section for descriptions of all object-specific tabs on the legacy Details screen.
• Follow Item: Select the Follow Item checkbox on the right side of the Navigation TabMenu to receive alerts and updates on changes to the object. After selecting this checkbox, select the desired notification priority level (Low, Medium, or High).

Overview Tab

The Overview tab of the legacy Details screen (Figure 1 and Figure 2) displays several cards with relevant information for the object you are viewing. Depending on the type of object you are viewing, the cards displayed on this tab will vary.

Indicators

Table 1 provides a description of each card that may be displayed on the Overview tab of the legacy Details screen for an Indicator and the Indicator types for which the card is available.

Groups

Table 2 provides a description of each card that may be displayed on the Overview tab of the legacy Details screen for a Group and the Group types for which the card is available.

Tags

Table 3 provides a description of each card that may be displayed on the Overview tab of the legacy Details screen for a Tag.

Tracks

Table 4 provides a description of each card that may be displayed on the Overview tab of the legacy Details screen for a Track.

Victims

Table 5 provides a description of each card that may be displayed on the Overview tab of the legacy Details screen for a Victim.

Tasks Tab

The Tasks tab (Figure 3) displays any Task Groups associated with the Indicator, Group, or Tag. To view the Details screen for an associated Task, click the Task’s name in the Subject column.

Activity Tab

The Activity tab (Figure 4) displays an activity list for the Indicator, Group, Tag, or Victim, including a summary of the activity performed and the date and time the activity occurred.

Associations Tab

The Associations tab (Figure 5) displays the object’s first-level associations and provides options for filtering the association objects and adding an association.

Spaces Tab

Object-Specific Tabs

Behavior Tab

File Indicators can model a special Indicator-to-Indicator association, which is based on their behavior once opened. These associations can be used to model the fact that malware may contain and create additional files or communicate with network devices The Behavior tab (Figure 7) of a File Indicator’s legacy Details screen can be used to model this behavior.

DNS Resolutions Tab

The DNS Resolutions tab (Figure 8), available for Address Indicators, displays Hosts that have resolved to the Address, presently or historically. This allows for the automated creation of associations between the Host and the Address, as well as enables pivoting.

DNS Tab

Host Indicators can leverage DNS resolution tracking for ongoing resolution changes. The DNS tab (Figure 9) for Host Indicators displays two sections:

• DNS Resolution History: This section lists the Addresses that have resolved to the Host Indicator, presently or historically.
• Passive DNS: This section, if available, provides the ability to view a list of the subdomain resolutions and historic IP address resolutions for the Host.

Whois Tab

The Whois tab (Figure 10) for Host Indicators provides WHOIS information, if available.

Sharing Tab

The Sharing tab (Figure 11) allows you to contribute a Group to a Community or Source, as well as publish a Group using the Publish feature. This tab is available on the legacy Details screen for the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Document, E-mail, Event, Incident, Intrusion Set, Malware, Report, Signature, Tactic, Threat, Tool, and Vulnerability.

Assets Tab

The Assets tab (Figure 12) allows you to add assets to an Adversary Group or Victim. Assets that can be added to an Adversary include handles (aliases), phone numbers, and website URLs. Assets that can be added to a Victim include email addresses, social network accounts, network accounts, websites, and phone numbers.

Tracking Tab

The Tracking tab (Figure 13) allows you to perform a Reverse Whois lookup on any assets added to an Adversary Group.

Results Tab

The Results tab (Figure 14), available only for Tracks, allows you to view domains found in a Reverse Whois lookup performed on an Adversary asset.

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20031-01 v.12.E