The Source Attribute
  • 05 May 2023
  • 5 Minutes to read
  • Dark
    Light

The Source Attribute

  • Dark
    Light

Article Summary

Overview

Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

When creating a Source Attribute for an Indicator, Group, or Victim in ThreatConnect, you can set the Attribute as the default Source Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Source Attribute is displayed on the Details card of the Overview tab and on the Attributes card; on the legacy Details screen, an object’s default Source Attribute is displayed on the Description card of the Overview tab and on the Attributes card.

Note
The Source Attribute is a separate entity from an Attribute Source. The Source Attribute provides information about the source of an object, whereas an Attribute Source provides information about the source of an Attribute.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing Source Attributes)
  • Organization role of Standard User (for creating, editing, and deleting Source Attributes)
PrerequisitesAn Indicator, Group, or Victim

Creating, Editing, and Deleting Sources

New Details Screen

On the new Details screen, you can view, create, and manage Source Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Event, Incident, Intrusion Set, Malware, Tactic, Threat, Tool, Vulnerability Groups. The new Details screen is not available for Document, Email, Report, Signature, and Task Groups; and Victims.

Creating a Source

You can create and view the default Source Attribute for an object on the Details card or the Attributes card of an object’s new Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Details Card
  1. Navigate to the Details screen for an object.
  2. On the Overview tab, click EditThe Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card. The Source section will now be editable (Figure 1). The Source Attribute_Figure 1

     

    • Source: Enter the Source Attribute’s value in plain text or Markdown. The goal of a good Source is to succinctly provide information on the origin of the object.
      Note
      See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
      Note
      The Source text box supports the Marked library (https://marked.js.org/).
    • Preview MarkdownThe Source Attribute_Markdown Icon: If you used Markdown when entering the Source Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
    • Click ConfirmThe Source Attribute_Confirm buttonat the top right of the Details card.

The object’s default Source Attribute will be displayed in the Source section of the Details card (Figure 2) and in the Source subsection of the Other Attributes section of the Attributes card (Figure 3).

Note
Only one Source Attribute can be designated as the default Source Attribute. If you add another default Source Attribute to an object via the Attributes card, the new default Source Attribute will replace the one on the Details card.

The Source Attribute_Figure 2

 

The Source Attribute_Figure 3

 

Attributes Card

You can create a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object by selecting Source as the Attribute Type in the Add Attribute window. Select the Default Attribute checkbox if creating a default Source Attribute. Creating a default Source Attribute via this method will allow you to add an Attribute Source and Security Labels, although they will not be displayed on the Details card. Only the text entered in the Value field will be displayed on the Details card.

Editing a Source

Details Card

Click EditThe Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, make the desired changes to the default Source Attribute’s value, and then click ConfirmThe Source Attribute_Confirm buttonat the top right of the Details card to save your changes. The changes will also be applied to the Source’s corresponding entry on the Attributes card.

Attributes Card

You can edit a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object. Editing a default Source Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the Attributes card. Refresh your screen to display the changes to the Source Attribute’s value on the Details card as well.

Deleting a Source

Details Card

Click EditThe Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, delete all contents in the Source text box, and then click ConfirmThe Source Attribute_Confirm buttonat the top right of the Details card to save your changes. The Source section of the Details card will now display the text None specified, indicating that no default Source Attribute has been added to the object. The Source’s entry will also be removed from the Attributes card.

Attributes Card

You can delete a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object. The Attribute will immediately be removed from the Attributes card. Refresh your screen to show that the Source Attribute has been removed from the Details card as well.

Legacy Details Screen

On the legacy Details screen, you can view, create, and manage Source Attributes for all Indicator types, all Group types, and Victims.

Creating a Source

You can create and view the default Source Attribute for an object on the Description/Source card of an Indicator’s legacy Details screen or the Attributes card of an object’s legacy Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Description/Source Card
  1. Navigate to the legacy Details screen for an Indicator.
  2. Scroll down to the Description/Source card on the left side of the screen. If no default Source Attribute has been added to the object, a message stating “No Default Source entered.” will be displayed (Figure 4). The Source Attribute_Figure 4

     

  3. Click the Click here to add one. link in the Source section. The Edit Attribute window will be displayed.
  4. Create the new default Source Attribute by keeping Source selected as the Attribute Type in the Edit Attribute window and leaving the Default checkbox selected. 
  5. After you configure and save the Attribute, the default Source Attribute will be displayed in the Source section of the Description/Source card (Figure 5) and on the Attributes card (Figure 6). The Source Attribute_Figure 5

     

    The Source Attribute_Figure 6

     

Attributes Card

You can create a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object by selecting Source as the Attribute Type in the Edit Attribute window. Select the Default checkbox if creating a default Source Attribute.

Editing a Source

You can edit a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. For Indicators, changes made to the default Source Attribute will be reflected on both the Attributes and Description/Source cards.

Note
You cannot edit the default Source Attribute for an Indicator from the Description/Source card; you can edit it from the Attributes card only.

Deleting a Source

You can delete a Source Attribute, either general (non-default) or default, from the Attributes card on the legacy Details screen for an object. The Attribute will be removed from the Attributes card and, for Indicators, from the Description/Source card.


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20017-01 v.09.B


Was this article helpful?