The Source Attribute

Updated on 05 May 2023
5 Minutes to read

Print
Dark

Light

Article Summary

Share feedback

Thanks for sharing your feedback!

Overview

Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect^® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.

When creating a Source Attribute for an Indicator, Group, or Victim in ThreatConnect, you can set the Attribute as the default Source Attribute to give it greater visibility on the Details screen. On the new Details screen, an object’s default Source Attribute is displayed on the Details card of the Overview tab and on the Attributes card; on the legacy Details screen, an object’s default Source Attribute is displayed on the Description card of the Overview tab and on the Attributes card.

Note

The Source Attribute is a separate entity from an Attribute Source. The Source Attribute provides information about the source of an object, whereas an Attribute Source provides information about the source of an Attribute.

Before You Start

Minimum Role(s)	Organization role of Read Only User (for viewing Source Attributes) Organization role of Standard User (for creating, editing, and deleting Source Attributes)
Prerequisites	An Indicator, Group, or Victim

Creating, Editing, and Deleting Sources

New Details Screen

On the new Details screen, you can view, create, and manage Source Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Event, Incident, Intrusion Set, Malware, Tactic, Threat, Tool, Vulnerability Groups. The new Details screen is not available for Document, Email, Report, Signature, and Task Groups; and Victims.

Creating a Source

You can create and view the default Source Attribute for an object on the Details card or the Attributes card of an object’s new Details screen. General (i.e., non-default) Source Attributes can be created and viewed on the Attributes card only.

Details Card

Navigate to the Details screen for an object.
On the Overview tab, click Edit at the top right of the Details card, or click on the Source section of the Details card. The Source section will now be editable (Figure 1).
- Source: Enter the Source Attribute’s value in plain text or Markdown. The goal of a good Source is to succinctly provide information on the origin of the object.
  Note
  See the “Using Markdown and ThreatConnect Markup in Attributes” section of Attributes for instructions on using Markdown when creating Attributes on the new Details screen.
  Note
  The Source text box supports the Marked library (https://marked.js.org/).
- Preview Markdown: If you used Markdown when entering the Source Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
- Click Confirmat the top right of the Details card.

The object’s default Source Attribute will be displayed in the Source section of the Details card (Figure 2) and in the Source subsection of the Other Attributes section of the Attributes card (Figure 3).

Note

Only one Source Attribute can be designated as the default Source Attribute. If you add another default Source Attribute to an object via the Attributes card, the new default Source Attribute will replace the one on the Details card.

The Source Attribute_Figure 2

The Source Attribute_Figure 3

Attributes Card

You can create a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object by selecting Source as the Attribute Type in the Add Attribute window. Select the Default Attribute checkbox if creating a default Source Attribute. Creating a default Source Attribute via this method will allow you to add an Attribute Source and Security Labels, although they will not be displayed on the Details card. Only the text entered in the Value field will be displayed on the Details card.

Editing a Source

Details Card

Click Edit The Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, make the desired changes to the default Source Attribute’s value, and then click Confirm The Source Attribute_Confirm button at the top right of the Details card to save your changes. The changes will also be applied to the Source’s corresponding entry on the Attributes card.

Attributes Card

You can edit a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object. Editing a default Source Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the Attributes card. Refresh your screen to display the changes to the Source Attribute’s value on the Details card as well.

Deleting a Source

Details Card

Click Edit The Source Attribute_Edit button at the top right of the Details card, or click on the Source section of the Details card, delete all contents in the Source text box, and then click Confirm The Source Attribute_Confirm button at the top right of the Details card to save your changes. The Source section of the Details card will now display the text None specified, indicating that no default Source Attribute has been added to the object. The Source’s entry will also be removed from the Attributes card.

Attributes Card

You can delete a Source Attribute, either general (non-default) or default, from the Attributes card on the new Details screen for an object. The Attribute will immediately be removed from the Attributes card. Refresh your screen to show that the Source Attribute has been removed from the Details card as well.