The Source Attribute
  • 27 Mar 2024
  • 5 Minutes to read
  • Dark
    Light

The Source Attribute

  • Dark
    Light

Article summary

Overview

Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

When creating a Source Attribute for an Indicator, Group, or Victim in ThreatConnect, you can set the Attribute as the default Source Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Source Attribute is displayed on the Details card of the Overview tab; on the legacy Details screen, an object’s default Source Attribute is displayed on the Description/Source and Attributes cards of the Overview tab.

Note
The Source Attribute is a separate entity from an Attribute Source. The Source Attribute provides information about the source of an object, whereas an Attribute Source provides information about the source of an Attribute.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing Source Attributes)
  • Organization role of Standard User (for creating, editing, and deleting Source Attributes)
PrerequisitesAn Indicator, Group, or Victim created in one of your ThreatConnect owners

Creating, Editing, and Deleting Sources

New Details Screen

On the new Details screen, you can view, create, and manage Source Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Document, Event, Incident, Intrusion Set, Malware, Report, Tactic, Threat, Tool, Vulnerability Groups. The new Details screen is not available for Email, Signature, and Task Groups; and Victims.

Note

If a Source Attribute is displayed in the Default Attributes section of the Attributes card on the new Details screen, it is because an Organization Administrator or a Director in a Community or Source configured the Source Attribute Type as a default Attribute Type on the Attribute Preferences tab of the Organization Config or Community (or Source) Config screen, respectively. However, this default Source Attribute is independent of the one displayed on the Details card, and updating either one of these Source Attributes will not affect the other.

In this article, references to the default Source Attribute are for the default Source Attribute displayed on the Details card on the new Details screen.

Creating a Source

You can create and view the default Source Attribute for an object on the Details card of an object’s new Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Details Card
  1. Navigate to the Details screen for an object.
  2. Click EditEdit button_Details card_Details screenat the top right of the Details card, or click on the Source section of the Details card. The Source section will now be editable (Figure 1). Figure 1_The Source Attribute_7.1.0

     

    • Source: Enter the Source Attribute’s value in plain text or Markdown. The goal of a good Source is to succinctly provide information on the origin of the object.
      Note
      See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
      Note
      The Source text box supports the Marked library (https://marked.js.org/).
    • Preview MarkdownMarkdown Icon: If you used Markdown when entering the Source Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
    • Click ConfirmConfirm icon_Details screenat the top right of the Details card.

The object’s default Source Attribute will be displayed in the Source section of the Details card (Figure 2).

Figure 2_The Source Attribute_7.1.0

 

Attributes Card

You can create a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object by selecting Source as the Attribute Type in the Add Attribute window. Creating a general Source Attribute via this method will allow you to add an Attribute Source and Security Labels to the Attribute.

To display a general Source Attribute in the Pinned Attributes section of the Attributes card, select the Set as Pinned Attribute checkbox in the Add Attribute window; otherwise, the Attribute will be displayed in the Other Attributes section of the Attributes card.

Editing a Source

Details Card

Click EditThe Source Attribute_Edit buttonat the top right of the Details card, or click on the Source section of the Details card, make the desired changes to the default Source Attribute’s value, and then click ConfirmThe Source Attribute_Confirm buttonat the top right of the Details card to save your changes.

Attributes Card

You can edit a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object. Editing a general Source Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the Attributes card.

Deleting a Source

Details Card

You can delete the default Source Attribute from the Details card on the new Details screen for an object. Click EditThe Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, delete all contents in the Source text box, and then click ConfirmThe Source Attribute_Confirm buttonat the top right of the Details card to save your changes. The Source section of the Details card will now display the text None specified, indicating that no default Source Attribute has been added to the object.

Attributes Card

You can delete a general (non-default) Source Attribute from the Attributes card on the new Details screen for an object. The Attribute will immediately be removed from the Attributes card.

Legacy Details Screen

On the legacy Details screen, you can view, create, and manage Source Attributes for all Indicator types, all Group types, and Victims.

Creating a Source

You can create and view the default Source Attribute for an object on the Description/Source card of an Indicator’s legacy Details screen or the Attributes card of an object’s legacy Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Description/Source Card
  1. Navigate to the legacy Details screen for an Indicator.
  2. Scroll down to the Description/Source card on the left side of the screen. If no default Source Attribute has been added to the object, a message stating “No Default Source entered.” will be displayed (Figure 3). Figure 3_The Source Attribute_7.1.0

     

  3. Click the Click here to add one. link in the Source section. The Edit Attribute window will be displayed.
  4. Create the new default Source Attribute by keeping Source selected as the Attribute Type in the Edit Attribute window and leaving the Default checkbox selected. 
  5. After you configure and save the Attribute, the default Source Attribute will be displayed in the Source section of the Description/Source card (Figure 4) and on the Attributes card (Figure 5). The Source Attribute_Figure 5

     

    The Source Attribute_Figure 6

     

Attributes Card

You can create a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object by selecting Source as the Attribute Type in the Edit Attribute window. Select the Default checkbox if creating a default Source Attribute.

Editing a Source

You can edit a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. For Indicators, changes made to the default Source Attribute will be reflected on both the Attributes and Description/Source cards.

Note
You cannot edit the default Source Attribute for an Indicator from the Description/Source card; you can edit it from the Attributes card only.

Deleting a Source

You can delete a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. The Attribute will be removed from the Attributes card and, for Indicators, from the Description/Source card.


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20017-01 v.10.A


Was this article helpful?