---
title: "The Source Attribute Knowledge Base Article | ThreatConnect"
slug: "the-source-attribute"
description: "This article discusses how to use and administrate the Source Attribute in ThreatConnect."
tags: ["Enriching Data", "Markdown"]
updated: 2024-03-27T20:11:19Z
published: 2024-03-27T20:11:19Z
canonical: "knowledge.threatconnect.com/the-source-attribute"
---
> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.
# The Source Attribute
## Overview
Sourcing data is one of the most basic and indispensable steps in conducting effective intelligence analysis. The Attribute system in ThreatConnect® makes it easy to apply unique sources to each data point, and it allows you to save a citation for easy access in the future.
When creating a Source Attribute for an Indicator, Group, or Victim in ThreatConnect, you can set the Attribute as the default Source Attribute to give it greater visibility on the **Details** screen. On the new **Details** screen, an object’s default Source Attribute is displayed on the **Details** card of the **Overview**tab; on the legacy **Details** screen, an object’s default Source Attribute is displayed on the **Description/Source** and **Attributes**cards of the **Overview** tab.
NoteThe Source Attribute is a separate entity from an Attribute Source. The Source Attribute provides information about the source of an object, whereas an Attribute Source provides information about the source of an Attribute.
## Before You Start
| Minimum Role(s) | - Organization role of Read Only User (for viewing Source Attributes) - Organization role of Standard User (for creating, editing, and deleting Source Attributes) |
| --- | --- |
| Prerequisites | An [Indicator](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicators), [Group](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#groups), or [Victim](https://knowledge.threatconnect.com/docs/create#creating-a-victim) created in one of your [ThreatConnect owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) |
## Creating, Editing, and Deleting Sources
### New Details Screen
On the new **Details**screen, you can view, create, and manage Source Attributes for all Indicator types and the following Group types: Adversary, Attack Pattern, Campaign, Course of Action, Document, Event, Incident, Intrusion Set, Malware, Report, Tactic, Threat, Tool, Vulnerability Groups. The new **Details**screen is not available for Email, Signature, and Task Groups; and Victims.
Note
If a Source Attribute is displayed in the **Default Attributes**section of the **Attributes**card on the new **Details**screen, it is because an Organization Administrator or a Director in a Community or Source configured the Source Attribute Type as a default Attribute Type on the **Attribute Preferences**tab of the **Organization Config**or **Community**(or **Source**) **Config**screen, respectively. However, this default Source Attribute is independent of the one displayed on the **Details**card, and updating either one of these Source Attributes will not affect the other.
In this article, references to the default Source Attribute are for the default Source Attribute displayed on the **Details**card on the new **Details**screen.
#### Creating a Source
You can create and view the default Source Attribute for an object on the **Details** card of an object’s new **Details** screen. General (i.e., non-default) Source Attributes can be created and viewed on the **Attributes** card only.
##### Details Card
1. [Navigate to the **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) for an object.
2. Click **Edit**at the top right of the **Details** card, or click on the **Source** section of the **Details** card. The **Source** section will now be editable (Figure 1). 
- **Source**: Enter the Source Attribute’s value in plain text or [Markdown](https://knowledge.threatconnect.com/docs/attributes#using-markdown-and-threatconnect-markup-in-attributes). The goal of a good Source is to succinctly provide information on the origin of the object.NoteSee the [“Using Markdown and ThreatConnect Markup in Attributes” section of *Attributes*](https://knowledge.threatconnect.com/docs/attributes#using-markdown-and-threatconnect-markup-in-attributes) for instructions on using Markdown when creating Attributes on the new **Details** screen.NoteThe **Source** text box supports the Marked library ([https://marked.js.org/](https://marked.js.org/)).
- **Preview Markdown**: If you used Markdown when entering the Source Attribute’s value, click this link to toggle to a preview of the value with the rendered Markdown formatting.
- Click **Confirm**at the top right of the **Details**card.
The object’s default Source Attribute will be displayed in the **Source**section of the **Details**card (Figure 2).
##### Attributes Card
You can create a general (non-default) Source Attribute [from the **Attributes** card on the new **Details** screen](https://knowledge.threatconnect.com/docs/attributes#creating-attributes) for an object by selecting **Source** as the **Attribute Type** in the **Add Attribute** window. Creating a general Source Attribute via this method will allow you to add an Attribute Source and Security Labels to the Attribute.
To display a general Source Attribute in the **Pinned Attributes**section of the **Attributes**card, select the **Set as Pinned Attribute**checkbox in the **Add Attribute**window; otherwise, the Attribute will be displayed in the **Other Attributes**section of the **Attributes**card.
#### Editing a Source
##### Details Card
Click **Edit**at the top right of the **Details**card, or click on the **Source**section of the **Details**card, make the desired changes to the default Source Attribute’s value, and then click **Confirm**at the top right of the **Details** card to save your changes.
##### Attributes Card
You can edit a general (non-default) Source Attribute [from the **Attributes** card on the new **Details**screen](https://knowledge.threatconnect.com/docs/attributes#editing-attributes) for an object. Editing a general Source Attribute via this method will allow you to edit the Attribute Source and Security Labels. The changes will immediately be displayed on the **Attributes** card.
#### Deleting a Source
##### Details Card
You can delete the default Source Attribute from the **Details**card on the new **Details**screen for an object. Click **Edit** at the top right of the **Details**card, or click on the **Source**section of the **Details**card, delete all contents in the **Source**text box, and then click **Confirm**at the top right of the **Details** card to save your changes. The **Source**section of the **Details**card will now display the text **None specified**, indicating that no default Source Attribute has been added to the object.
##### Attributes Card
You can delete a general (non-default) Source Attribute [from the **Attributes** card on the new **Details**screen](https://knowledge.threatconnect.com/docs/attributes#deleting-attributes) for an object. The Attribute will immediately be removed from the **Attributes** card.
### Legacy Details Screen
On the legacy **Details** screen, you can view, create, and manage Source Attributes for all Indicator types, all Group types, and Victims.
#### Creating a Source
You can create and view the default Source Attribute for an object on the **Description/Source** card of an Indicator’s legacy **Details** screen or the **Attributes**card of an object’s legacy **Details**screen. General (i.e., non-default) Source Attributes can be created and viewed on the **Attributes** card only.
##### Description/Source Card
1. [Navigate to the legacy **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for an Indicator.
2. Scroll down to the **Description/Source** card on the left side of the screen. If no default Source Attribute has been added to the object, a message stating “No Default Source entered.” will be displayed (Figure 3). 
3. Click the **Click here to add one.** link in the **Source** section. The **Edit Attribute** window will be displayed.
4. [Create the new default **Source**Attribute](https://knowledge.threatconnect.com/docs/attributes#creating-attributes1) by keeping **Source** selected as the **Attribute Type** in the **Edit Attribute** window and leaving the **Default**checkbox selected.
5. After you configure and save the Attribute, the default Source Attribute will be displayed in the **Source**section of the **Description/Source** card (Figure 4) and on the **Attributes** card (Figure 5). 
##### Attributes Card
You can create a Source Attribute, either general (non-default) or default, [from the **Attributes** card on the legacy **Details** screen](https://knowledge.threatconnect.com/docs/attributes#creating-attributes1) for an object by selecting **Source** as the **Attribute Type** in the **Edit Attribute** window. Select the **Default**checkbox if creating a default Source Attribute.
#### Editing a Source
You can edit a Source Attribute, either general (non-default) or default, [from the **Attributes** card on the legacy **Details**screen](https://knowledge.threatconnect.com/docs/attributes#editing-attributes1) for an object. For Indicators, changes made to the default Source Attribute will be reflected on both the **Attributes**and **Description/Source**cards.
NoteYou cannot edit the default Source Attribute for an Indicator from the **Description/Source**card; you can edit it from the **Attributes**card only.
#### Deleting a Source
You can delete a Source Attribute, either general (non-default) or default, [from the **Attributes** card on the legacy **Details**screen](https://knowledge.threatconnect.com/docs/attributes#deleting-attributes1) for an object. The Attribute will be removed from the **Attributes** card and, for Indicators, from the **Description/Source** card.
---
*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*
20017-01 v.10.A
## Related
- [Attributes](/attributes.md)
- [The Description Attribute](/the-description-attribute.md)
- [The Details Screen](/the-details-screen.md)