--- title: "The \"Last Modified\" Date Knowledge Base Article | ThreatConnect" slug: "the-last-modified-date" description: "This article describes the areas in ThreatConnect where you can view the date and time when an object was last modified. It also details whether certain actions you can perform update the date and time when an object was last modified." tags: ["Viewing Data"] updated: 2024-11-25T20:44:20Z published: 2024-11-25T20:44:20Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # The "Last Modified" Date ## Overview When viewing [Indicators](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicators), [Groups](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#groups), [Intelligence Requirements (IRs)](https://knowledge.threatconnect.com/docs/intelligence-requirements), and [Attributes](https://knowledge.threatconnect.com/docs/attributes) in ThreatConnect®, the **Last Modified**field provides the date and time when the object was last modified. Similarly, the `lastModified` API field provides the date and time when an Indicator, Group, IR, or Attribute was last modified when using the [ThreatConnect API](https://knowledge.threatconnect.com/docs/api-documentation) to interact with these object types. This article describes the various areas in ThreatConnect where you can view the date and time when an Indicator, Group, or Attribute was last modified. It also details actions you can perform when working with these object types and whether each action updates the **Last Modified**date. ## Before You Start ### User Roles - To view the date and time when Indicators, Groups, IRs, and Attributes in an Organization were last modified, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To view the date and time when Indicators, Groups, and Attributes in a Community or Source were last modified, your user account can have any [Community role](https://knowledge.threatconnect.com/docs/community-roles) except Banned. - To view the date and time when Indicators, Groups, IRs, and Attributes were last modified via the ThreatConnect API, your user account must have a [System role](https://knowledge.threatconnect.com/docs/threatconnect-system-roles-and-permissions) of API User. ## Viewing an Object’s “Last Modified” Date ### ThreatConnect UI There are five main areas in ThreatConnect where you can view the date and time when an object was last modified: - the [**Browse**screen](/docs/the-last-modified-date#browse-screen) - the [**Details**drawer](/docs/the-last-modified-date#details-drawer) - the [**Details**screen](/docs/the-last-modified-date#details-screen) - the [legacy **Details**screen](/docs/the-last-modified-date#legacy-details-screen) - the [**Search**screen](/docs/the-last-modified-date#search-screen) HintTo view a log of changes made to an object in your Organization, including the date and time when the action was performed, navigate to the **Activity** tab of the **Organization Settings** screen. This tab is available only to users with an [Organization role](/v1/docs/organization-roles) of Organization Administrator. #### Browse Screen While viewing Indicators, Groups, or IRs on the [**Browse** screen](https://knowledge.threatconnect.com/docs/the-browse-screen), the results table includes a **Modified**column that provides the date when an object was last modified (Figure 1). ![Figure 1_The Last Modified Date_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20Last%20Modified%20Date_7.7.1.png) HintYou can use the **FILTERS**menu on the **Browse**screen to [filter results](https://knowledge.threatconnect.com/docs/the-browse-screen#filtering-results) by the date when they were last modified. Additionally, you can use the **Browse**screen’s advanced search feature to [run a ThreatConnect Query Language (TQL) query](https://knowledge.threatconnect.com/docs/running-advanced-searches-with-tql) that uses the `lastModified` [TQL parameter](https://knowledge.threatconnect.com/docs/tql-operators-and-parameters) to filter results based on the date when they were last modified. #### Details Drawer On the [**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) for Indicators and Groups, the **Last Modified**field in the top portion of the drawer provides the date and time when the object was last modified in the owner listed in the drawer’s header. Figure 2 shows the **Details**drawer for an Indicator, along with the date and time when the Indicator was last modified in the owner named “Demo Organization.” ![Graphical user interface, text, application, email, website Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_The%20Last%20Modified%20Date_7.7.1.png) NoteThe **Details**drawer’s **[](https://knowledge.threatconnect.com/docs/the-details-drawer#unified-view)**[](https://knowledge.threatconnect.com/docs/the-details-drawer#unified-view)[**Unified View**](https://knowledge.threatconnect.com/docs/the-details-drawer#unified-view)**[](https://knowledge.threatconnect.com/docs/the-details-drawer#unified-view)****[](https://knowledge.threatconnect.com/docs/the-details-drawer#unified-view)**option for Indicators includes a **Last Modified**field that provides the most recent date and time when an Indicator was last modified in any of its owners. In addition, an Attribute’s **Last Modified**field on the **Attributes**card on the **Details**drawer provides the date and time when the Attribute was last modified (Figure 3). ![Figure 3_The Last Modified Date_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_The%20Last%20Modified%20Date_7.7.1.png) NoteIf viewing the **[](https://knowledge.threatconnect.com/docs/the-details-drawer#email-signature-and-task)** [](https://knowledge.threatconnect.com/docs/the-details-drawer#email-signature-and-task)[**Details**drawer for an Email, Signature, or Task Group](https://knowledge.threatconnect.com/docs/the-details-drawer#email-signature-and-task)[](https://knowledge.threatconnect.com/docs/the-details-drawer#email-signature-and-task)**[](https://knowledge.threatconnect.com/docs/the-details-drawer#email-signature-and-task)**, the **Last Modified**field for the Group is located at the top right of the drawer, and the date and time when each of the Group’s Attributes was last modified is located in the **Last Modified**column of the **Attributes**section on the drawer. #### Details Screen On the [**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) for Indicators, Groups, and IRs, the **Last Modified**field on the **Details**card provides the****date and time when the object was last modified in the owner listed in the screen’s header (Figure 4). ImportantThe new **Details** screen is not currently available for Email, Signature, and Task Groups. As such, you can view the **Last Modified**date for these Group types and their Attributes on the legacy **Details** screen only. ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_The%20Last%20Modified%20Date_7.7.1.png) In addition, an Attribute’s **Last Modified**field on the **Attributes**card provides the date and time when the Attribute was last modified (Figure 5). The **Attributes**card is available on the **Details**screen for Indicators and Groups only. ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_The%20Last%20Modified%20Date_7.7.1.png) #### Legacy Details Screen On the [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)for Indicators and Groups, the **Modified**field on the **Details**card provides the****date and time when the object was last modified in the owner listed at the top right of the screen (Figure 6). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_The%20Last%20Modified%20Date_7.7.1.png) In addition, an Attribute’s **Last Updated**field on the **Attributes**card provides the date and time when the Attribute was last modified (Figure 7). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_The%20Last%20Modified%20Date_7.7.1.png) #### Search Screen When [searching your ThreatConnect data on the **Search**screen](https://knowledge.threatconnect.com/docs/searching-your-data), the [search results table](https://knowledge.threatconnect.com/docs/viewing-search-results) includes a **Last Modified**column that provides the date and time when an object was last modified in the owner listed in the **Owner**column (Figure 8). ![Figure 8_The Last Modified Date_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_The%20Last%20Modified%20Date_7.7.1.png) ### ThreatConnect API When using the ThreatConnect API to interact with Indicators, Groups, IRs, and Attributes, the `lastModified` API field provides the date and time when an object was last modified. The [v3 API](https://docs.threatconnect.com/en/latest/rest_api/rest_api.html#v3-api) includes the `lastModified` API field for Indicators, Groups, IRs, and Attributes; the [v2 API](https://docs.threatconnect.com/en/latest/rest_api/rest_api.html#v2-api) includes the `lastModified` API field for Indicators and Attributes only. NoteFor [Case Attributes](https://knowledge.threatconnect.com/docs/case-attributes), you can view the date and time when they were last modified using the v3 API. However, you cannot view this date and time in the ThreatConnect UI. ## Updating an Object’s “Last Modified” Date ### Indicators Table 1 details the actions you can perform when working with Indicators and whether each one updates the date and time when an Indicator was last modified. | Action(s) | Applies to Which Indicator Type(s)? | Updates "Last Modified" Date? | | --- | --- | --- | | Applying or removing [Security Labels](https://knowledge.threatconnect.com/docs/applying-security-labels) | All | Yes1, 2 | | [Associating](https://knowledge.threatconnect.com/docs/associations) Groups or Indicators to an Indicator | All | Yes | | Associating [Cases](https://knowledge.threatconnect.com/docs/workflow-cases) or [Artifacts](https://knowledge.threatconnect.com/docs/artifacts) to an Indicator | All | No3 | | Dissociating Groups or Indicators from an Indicator | All | No2 | | Dissociating Cases or Artifacts from an Indicator | All | No3 | | Updating objects associated to an Indicator | All | No | | Creating, updating, or deleting [**Description**](https://knowledge.threatconnect.com/docs/the-description-attribute)****or [**Source**](https://knowledge.threatconnect.com/docs/sourcing-data)****Attributes with or without the **Default**checkbox selected | All | Yes | | Creating or updating [Attributes](https://knowledge.threatconnect.com/docs/creating-attributes) | All | Yes1 | | Deleting Attributes | All | Yes | | Creating [posts](https://knowledge.threatconnect.com/docs/posts) via the **Add New Comment**card of an Indicator’s **Details**screen or deleting posts added or linked to an Indicator | All | No | | Applying or removing [Tags](https://knowledge.threatconnect.com/docs/applying-tags) | All | Yes | | [Following](https://knowledge.threatconnect.com/docs/notifications-and-following#following-items) or unfollowing an Indicator | All | No | | Adding a [Task](https://knowledge.threatconnect.com/docs/assigning-tasks#tasks-tab-of-the-details-screen) to an Indicator | All | No | | Updating or deleting a Task added to an Indicator | All | No | | Reporting [false positives](https://knowledge.threatconnect.com/docs/viewing-and-reporting-false-positives) or deleting false positive reports for an Indicator | All | No | | Reporting observations for an Indicator | All | No | | Updating an Indicator’s [Threat Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) | All | Yes | | Updating an Indicator’s [Confidence Rating](https://knowledge.threatconnect.com/docs/setting-indicator-threat-and-confidence-ratings) | All | Yes | | ThreatConnect updates an Indicator’s [ThreatAssess score](https://knowledge.threatconnect.com/docs/threatassess-and-cal#threatassess) | All | No | | Updating an Indicator's [Status](https://knowledge.threatconnect.com/docs/indicator-status) | All | Yes | | Turning the [CAL Status Lock](https://knowledge.threatconnect.com/docs/en/indicator-status#cal-and-indicator-status) on or off | All | Yes | | Marking an Indicator as [private](https://knowledge.threatconnect.com/docs/private-indicators) | All | Yes | | Reimporting an existing Indicator | All | Yes | | Creating, updating, or deleting [File Occurrences](https://knowledge.threatconnect.com/docs/managing-file-hashes-and-known-file-occurrences#known-file-occurrences) | File | Yes1, 2 | | Updating a File’s [behavior model](https://knowledge.threatconnect.com/docs/modeling-file-behavior) | File | No | | Adding or removing a file hash | File | Yes | | Adding, updating, or removing a File Indicator’s size value | File | Yes | | Turning the [DNS resolution tracking feature](https://knowledge.threatconnect.com/docs/dns-resolutions) on or off | Host | Yes1, 2 | | Turning the [WHOIS feature](https://knowledge.threatconnect.com/docs/whois-registration-information) on or off | Host | Yes1, 2 | 1 Performing this action on the legacy **Details** screen *will not update* the **Last Modified** date. 2 Performing this action via the ThreatConnect v3 API will update the **Last Modified**date; however, performing this action via the ThreatConnect v2 API *will not update*the **Last Modified**date. 3 Performing this action via the ThreatConnect v3 API will update the **Last Modified**date; however, this action may not be performed using the ThreatConnect v2 API, as it does not support Workflow-related features. ### Groups Table 2 details the actions you can perform when working with Groups and whether each one updates the date and time when a Group was last modified. | Action(s) | Applies to Which Group Type(s)? | Updates "Last Modified" Date? | | --- | --- | --- | | Applying or removing [Security Labels](https://knowledge.threatconnect.com/docs/applying-security-labels) | All | Yes | | [Associating](https://knowledge.threatconnect.com/docs/associations) Groups, Indicators, Victim Assets, [Cases](https://knowledge.threatconnect.com/docs/workflow-cases), or [Artifacts](https://knowledge.threatconnect.com/docs/artifacts) to a Group | All | Yes | | Dissociating Groups, Indicators, Victim Assets, Cases, or Artifacts from a Group | All | Yes | | Updating objects associated to a Group | All | No | | Creating, updating, or deleting [**Description**](https://knowledge.threatconnect.com/docs/the-description-attribute)****or [**Source**](https://knowledge.threatconnect.com/docs/sourcing-data)****Attributes with or without the **Default**checkbox selected | All | Yes | | Creating, updating, or deleting [Attributes](https://knowledge.threatconnect.com/docs/creating-attributes) | All | Yes | | Creating [posts](https://knowledge.threatconnect.com/docs/posts) via the **Add New Comment**card of a Group’s **Details**screen | All | Yes | | Deleting posts added or linked to a Group | All | No1 | | Applying or removing [Tags](https://knowledge.threatconnect.com/docs/applying-tags) | All | Yes | | [Following](https://knowledge.threatconnect.com/docs/notifications-and-following#following-items) or unfollowing a Group | All | No | | Adding a [Task](https://knowledge.threatconnect.com/docs/assigning-tasks#tasks-tab-of-the-details-screen) to a Group | All | Yes | | Updating or deleting a Task added to a Group | All | No2 | | [Updating a Group's Intel Rating](https://knowledge.threatconnect.com/docs/voting-for-a-group) | All | Yes | | [Contributing a Group to a Community or Source](https://knowledge.threatconnect.com/docs/contributing-a-group-to-a-community-or-source) | All | No | | [Copying a Group from a Community to an Organization](https://knowledge.threatconnect.com/docs/copying-from-a-community) | All | No3 | | [Publishing a Group](https://knowledge.threatconnect.com/docs/the-publish-feature) | All | Yes | | Updating a Group’s summary | All | Yes | | [Generating a PDF report of a Group](https://knowledge.threatconnect.com/docs/generating-a-report-pdf-for-a-group) | All Group types except Document, Email, Signature, and Task | No | | Adding an [Adversary asset](https://knowledge.threatconnect.com/docs/adding-adversary-assets) | Adversary | Yes | | Deleting an Adversary asset | Adversary | No | | Enabling or disabling a [Track](https://knowledge.threatconnect.com/docs/tracking-adversary-activity) | Adversary | No | | Track results are found for an Adversary | Adversary | No | | Adding, updating, or removing a Campaign’s **First Seen**date | Campaign | Yes | | Updating the file name of the file corresponding to a Document | Document | Yes | | Downloading the file corresponding to a Document | Document | No | | Uploading a file to a Document | Document | Yes | | Updating the analysis for an Email (i.e., updating the **Body**, **From** field, **Header**, or **Subject** of the email corresponding to the Group) | Email | Yes | | Adding, updating, or removing an Event’s **Event Date** | Event | Yes | | Adding or updating an Event’s **Status** | Event | Yes | | Adding, updating, or removing an Incident’s **Event Date** | Incident | Yes | | Adding or updating an Incident’s **Status** | Incident | Yes | | Downloading the file corresponding to a Report | Report | No | | Uploading a file to a Report | Report | Yes | | Adding, updating, or removing a Report’s **Publish Date** | Report | Yes | | Downloading a Signature’s file contents | Signature | No | | Importing a new Signature file | Signature | Yes | | Updating a Signature file’s name, type, or contents | Signature | Yes | | Adding or removing [Task](https://knowledge.threatconnect.com/docs/assigning-tasks) Assignees | Task | Yes | | Adding or removing users to whom a Task is to be escalated | Task | Yes | | Adding or updating a Task’s **Status** | Task | Yes | | Adding, updating, or removing a Task’s **Due Date** | Task | Yes | | Adding, updating, or removing a Task’s **Escalation Time** | Task | Yes | | Adding, updating, or removing a Task’s **Reminder Time** | Task | Yes | 1 Performing this action on the legacy **Details** screen *will update* the **Last Modified** date. 2 If updating a Task added to a Group, the **Last Modified**date for the Group to which the Task was added *will not* be updated, but the **Last Modified**date for the Task *will* be updated. 3 The **Last Modified**date for the Group that exists in the Community will not be updated; the **Last Modified**date for the copy of the Group created in the Organization will match the **Date Added**date. ### Intelligence Requirements Table 3 details the actions you can perform when working with IRs and whether each one updates the date and time when an IR was last modified. | Action(s) | Updates “Last Modified” Date? | | --- | --- | | [Associating](https://knowledge.threatconnect.com/docs/associations) Groups, Indicators, Victim Assets, [Artifacts](https://knowledge.threatconnect.com/docs/artifacts), or [Cases](https://knowledge.threatconnect.com/docs/workflow-cases) to an IR | Yes | | Dissociating Groups, Indicators, Victim Assets, Artifacts, or Cases from an IR | Yes | | Updating objects associated to an IR | No | | Adding or updating the IR's default [Description Attribute](https://knowledge.threatconnect.com/docs/the-description-attribute) | Yes | | Updating an IR's subtype | Yes | | Updating an IR's [category](https://knowledge.threatconnect.com/docs/intelligence-requirement-categories) | Yes | | Applying or removing [Tags](https://knowledge.threatconnect.com/docs/applying-tags) | Yes | | [Following](https://knowledge.threatconnect.com/docs/notifications-and-following#following-items) or unfollowing an IR | No | | Updating an IR's summary | Yes | | Updating an IR's [keyword query](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#keyword-tracking) | Yes | | Resetting archived and false results for an IR | Yes | | [Retrieving results](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#results) for an IR | Yes | | [Associating a result](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#results) to an IR | Yes | | [Archiving a result](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#results) for an IR | No | | [Marking a result for an IR as a false result](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#results) | No | ### Attributes Table 4 details the actions you can perform when working with Attributes and whether each one updates the date and time when an Attribute was last modified. | Action(s) | Updates "Last Modified" Date? | | --- | --- | | Applying or removing [Security Labels](https://knowledge.threatconnect.com/docs/applying-security-labels) | Yes | | Creating, updating, or removing an Attribute’s [Source](https://knowledge.threatconnect.com/docs/creating-attributes) | Yes | | Updating an Attribute’s [value](https://knowledge.threatconnect.com/docs/creating-attributes) | Yes | | Saving an Attribute’s Source so that it can be reused by the same owner | No1 | | Selecting or clearing the **Default**checkbox for [**Description**](https://knowledge.threatconnect.com/docs/the-description-attribute)****and [**Source**](https://knowledge.threatconnect.com/docs/sourcing-data)****Attributes | Yes | 1 Performing this action on the legacy **Details** screen *will update* the **Last Modified** date. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20132-01 v.04.B ## Related - [API Documentation](/api-documentation.md) - [Attributes](/attributes.md) - [The Browse Screen](/the-browse-screen.md) - [The Details Drawer](/the-details-drawer.md) - [The Details Screen](/the-details-screen.md) - [The Details Screen (Legacy)](/the-details-screen-legacy.md) - [Viewing Intelligence Requirement Details](/viewing-intelligence-requirement-details.md)