Adding Artifacts to a Case

To create an Artifact and add it to a Case, click the New… button at the upper-right corner of the Case select Artifact, or hover the cursor over the Artifacts card and click New Artifactat the upper-right corner of the card. The Create Artifact drawer will be displayed (Figure 1).

• Type: Select the type of Artifact to add.
• Summary: Enter the Artifact itself in this field. If a file Artifact type has been selected from the Type dropdown menu, a Drag and drop, or click to select a file. box will be displayed. Use this box to upload the desired file for the Artifact.
• Associated Task: Select the Task with which the Artifact should be associated, if desired.
  Note

  It is recommended to review the default selection in the Associated Task field and change it to the desired Task or select No Task if you do not want to associate the Artifact with a Task.
• Associated Fields: If desired, you can associate the Artifact with a specific input field in the Associated Task if the type of Artifact being created matches the Artifact type for which the input field is configured. Use the dropdown menu to select an input field from the associated Task. If the only option is No Field, then the selected Associated Task does not have any input fields whose associated Artifact type matches the type selected in the Type dropdown.
• Note: Enter a Note, either in plain text or in Markdown, to link to the Artifact. If using Markdown, click the Preview Markdownlink to preview the text with the rendered Markdown formatting.
  Note

  The Note text box supports the Marked library (https://marked.js.org/).
• Source: If desired, change the default name of the source of the Artifact (i.e., the user who entered the Artifact).
• Use to potentially associate cases.: Selecting this checkbox will cause Cases that include the Artifact to populate in the Cases section of the Potential Associations card. In other words, any Case that contains this Artifact will be considered to be potentially related to this Case because both Cases contain the same Artifact. In addition, any Cases that include the Artifact will be listed in the CASES dropdown in the Links column of the Artifacts table for the Artifact.
  Important

  The default setting for this checkbox may vary across Artifact types. Also, if a System Administrator has disallowed the Artifact from being used to potentially associate Cases, then selection of this checkbox will not have any effect.
• Click the CREATE button. The Artifact will be added to the Artifacts table.

If an Associated Task and Associated Field are selected, the Artifact will be added to the Artifacts table with the Associated Task and Associated Field listed in the Task column (Figure 2), and the Artifact will be populated in the input field for the Associated Task.

If No Field is selected from the Associated Fields dropdown menu, only the Associated Task will be listed in the Task column of the Artifacts table, and a link to view the related Artifact will be added at the bottom of the Task Artifacts section of the Associated Task (Figure 3).

If no associated Task is selected, then the Artifact will be added to the Artifacts table, but will not be associated with a Task (i.e., the Task column for the Artifact will be empty).

You can also add a new Artifact to a Task as a related Artifact by clicking the vertical ellipsis on the right side of the Task and selecting Add Artifact. By default, the Create Artifact drawer associates the Artifact to the first Task in the Case that has not yet been completed (i.e., the default entry in the Associated Task dropdown). To associate the Artifact to the Task from which the Add Artifact option was selected, change this selection. See the “Add Artifact” section of the Task Administrative Options for more information.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20123-03 v.02.B